Cache-Control: must-revalidate

Forbids serving stale responses without successful revalidation once they expire.

Without it, caches may serve stale content in some cases (such as disconnected operation). It only applies after the response becomes stale.

httpcacheheaderdirective

Reference (http)

Cache-Control: max-age=3600, must-revalidate

Without it, caches may serve stale content in some cases (such as disconnected operation). It only applies after the response becomes stale.

Common mistakes

Expecting must-revalidate to prevent stale serving before expiry; use no-cache for that.

Sources