max-age=3600 — cache for N secondsno-cache — always revalidate with the server (but may use cached response on 304 Not Modified)no-store — do not cache at all (sensitive data)public — may be cached by proxies and CDNsprivate — browser only (personalised data)immutable — content will never change; browser skips revalidation until max-age expiresETag is a content hash. On the next request the browser sends If-None-Match. The server returns 304 Not Modified if the content has not changed — no response body. Saves bandwidth.
Static files with a hash in the filename (app.abc123.js) → Cache-Control: public, max-age=31536000, immutable. Infinite cache; a new deploy means a new hash = a new URL.