How can I detect and handle stale cache responses in an Express application using Cache-Control validation?

Handling Stale Cache Validation

To ensure clients detect stale content and trigger revalidation without downloading the full payload, you must combine Cache-Control directives with Validators (ETags or Last-Modified timestamps). In Express, the most reliable way to force a stale state while preserving validation is using no-cache or max-age=0, must-revalidate.

The Recommended Header Combination

Contrary to its name, no-cache does not stop the browser from caching; it stops the browser from using the cache without first validating it with the server. This is the ideal setting for your requirements.

app.get('/api/data', (req, res) => {
  // Force the client to revalidate every time
  res.set('Cache-Control', 'no-cache');
  
  // Express generates ETags by default. 
  // If the body hasn't changed, Express automatically sends a 304.
  res.json({ data: "Your dynamic content" });
});

How Validation Works in Express

• ETags (Default): Express generates a hash of the response body. The server sends this in the ETag header. The client sends it back in the If-None-Match header on the next request.
• Last-Modified: If you manually set a Last-Modified header, the client will send If-Modified-Since.
• The 304 Response: If the ETag or timestamp matches the current server state, Express terminates the request early and sends a 304 Not Modified status with no body.

Verification and Inspection

To verify that a stale cache entry is triggering a validation request rather than a full download, use curl to inspect the headers:

1. Initial Request: Observe the ETag and Cache-Control headers.

   curl -v http://localhost:3000/api/data

2. Validation Request: Pass the ETag back using the -H flag to simulate a browser's conditional request.

   curl -v -H 'If-None-Match: "your-etag-value"' http://localhost:3000/api/data

If configured correctly, the second request will return HTTP/1.1 304 Not Modified.

Logging Fresh vs. Stale Responses

Express does not log 304s as distinct "cache hits" by default. To expose this in your logs, implement a small middleware to track the status code:

app.use((req, res, next) => {
  res.on('finish', () => {
    if (res.statusCode === 304) {
      console.log(`[Cache] ${req.method} ${req.url} - Served from Cache (304)`);
    } else if (res.statusCode === 200) {
      console.log(`[Cache] ${req.method} ${req.url} - Served Fresh (200)`);
    }
  });
  next();
});

Diagnostic Note: Are you using a reverse proxy (like Nginx or Cloudflare) between the client and Express? If so, the proxy may override these headers or serve its own cached version, which would prevent the request from ever reaching your Express logs.