title: HTTP Cache-Control header works only on localhost
body: <p>I'm trying to configure caching with <code>Cache-Control</code> for a REST endpoint in my webapp, it works locally, but when I deploy on our production server the browser just won't cache the responses.</p>
  
  <p>The endpoint is queried via a parametrized ajax request (as shown below).</p>
  
  <p>Some relevant notes :</p>
  
  <ul>
  <li><p>I use a <em>cache buster</em> parameter (<code>_</code>) that is a unix timestamp generated at page load. It doesn't change across ajax requests.</p></li>
  <li><p>localhost is on HTTP whereas production is on HTTPS. The certificate is valid and there are no related errors.</p></li>
  <li><p>Both Firefox 59.0.2 and Chrome 66.0.3359.139 exhibit this behavior, so I assume this is something in the configuration.</p></li>
  </ul>
  
  <h2>Localhost</h2>
  
  <pre class="lang-none prettyprint-override"><code>Request URL: http://localhost:8080/webapp/rest/events?_=1525720266960&amp;start=2018-04-29&amp;end=2018-06-10
  Request Method: GET
  Status Code: 200 OK
  Referrer Policy: no-referrer-when-downgrade
  
  === Request ===
  Accept: application/json, text/javascript, */*; q=0.01
  Accept-Encoding: gzip, deflate, br
  Connection: keep-alive
  Cookie: JSESSIONID=&lt;token&gt;
  Host: localhost:8080
  Referer: http://localhost:8080/webapp/
  X-Requested-With: XMLHttpRequest
  
  === Response ===
  Cache-Control: no-transform, max-age=300, private
  Connection: keep-alive
  Content-Length: 5935
  Content-Type: application/json
  </code></pre>
  
  <p>Following requests (for the same parameters) are effectively loaded from cache with the only difference being : <code>Status Code: 200 OK (from disk cache)</code></p>
  
  <p>Which seems fine, since I don't want to revalidate. The resource should only be fetched again, without validation, once it has gone stale after the duration of <code>max-age</code> specified by <code>Cache-Control</code>.</p>
  
  <hr>
  
  <h2>Production</h2>
  
  <pre class="lang-none prettyprint-override"><code>Request URL: https://www.example.org/webapp/rest/events?_=1525720216575&amp;start=2018-04-29&amp;end=2018-06-10
  Request Method: GET
  Status Code: 200 OK
  Referrer Policy: no-referrer-when-downgrade
  
  === Request ===
  Accept: application/json, text/javascript, */*; q=0.01
  Accept-Encoding: gzip, deflate, br
  Connection: keep-alive
  Cookie: JSESSIONID=&lt;token&gt;
  Host: www.example.org
  Referer: https://www.example.org/webapp/
  X-Requested-With: XMLHttpRequest
  
  === Response ===
  Cache-Control: no-transform, max-age=300, private
  Connection: close
  Content-Length: 5935
  Content-Type: application/json
  </code></pre>
  
  <p>In this case, the response is never loaded from cache afterwards.</p>
  
  <hr>
  
  <p>I've stripped some headers that I thought superfluous (<code>Server</code>, <code>X-Powered-By</code>, <code>User-Agent</code>, <code>Date</code>).</p>
  
  <h1>Question</h1>
  
  <p><strong>What prevents the reponses to be cached by the browser when talking to the production server ?</strong></p>