Cache-Control is an HTTP response header that specifies whether and how a response may be stored and reused by browsers, proxies, and other caches. Directives such as no-store, no-cache, and max-age affect storage and freshness; they have different meanings and should not be treated as interchangeable.
In cyber security, cache rules matter because cached content can persist or be served in ways developers did not expect. A misconfigured cache may expose private responses, reuse stale content, or complicate the handling of redirects and transformed files. When assessing an image-processing service, defenders should check the response’s cache directives and how browsers and intermediaries handle the resulting content. Cache-Control is one part of the defense, not a substitute for safely validating content and controlling redirects.