What do Cache-Control public and private mean?

private and public are `Cache-Control` response directives that decide who may store a response. private means only a private cache, such as the browser, may store it, so a CDN must not. public means any cache may store it, even when it would not be cacheable by default, such as a response to an authenticated request.

Cache-Control: private, max-age=300

Cache-Control: public, s-maxage=3600

The Authorization case matters for CDNs. RFC 9111 (section 3.5) says a shared cache must not reuse a response to a request with an Authorization header unless the response carries a directive that allows shared caching, such as public, `s-maxage` or `must-revalidate`.

• public is not needed for ordinary cacheable responses: a `max-age` is enough to make them storable.
• private is not a security control. It keeps a response out of shared caches, but the browser still stores it. Use `no-store` for data that must not persist.
• Cookies personalize pages without Authorization. Cloudflare, for example, does not cache a response that sets Set-Cookie by default.