Set Cache-Control with an explicit max-age and a scope: public for shared CDN caching, private for per user data. Add stale-while-revalidate so clients serve slightly old data while refreshing in the background. Include an ETag or Last-Modified so revalidation is a cheap 304 instead of a full body. For anything user specific, set Vary on Authorization or Cookie so caches never cross wires between accounts.
Why interviewers ask this
Caching is where full stack developers either save real money or leak other people's data, so the interviewer is probing both performance instinct and safety instinct. They want to see that you know the difference between browser, CDN and origin caches, that you can name the headers rather than gesture at them, and that you immediately think about the private data failure mode without being prompted.
How to structure your answer
- Name the header that sets the policy and its key directives.
- Explain revalidation with ETag and the 304 response.
- Cover the private data case and Vary.
- Mention how you invalidate when data changes.
Example answer
First question I ask is who is allowed to hold this response. If it is the same for everyone, public with a real max-age lets the CDN absorb the traffic and the origin barely sees it. If it is per account, it has to be private, and I set Vary on Authorization so a shared cache cannot serve one user's payload to another. That mistake is quiet and catastrophic, so I check it explicitly. Then I add an ETag, because a 304 costs a few hundred bytes instead of the full body, and stale-while-revalidate so a user never waits on a refresh. For anything that must be current, I flip to a short max-age plus revalidation rather than no-store, since no-store throws away the cheap win. On the last API I worked on, moving a public pricing endpoint from no-cache to sixty seconds public with stale-while-revalidate cut origin requests by roughly 90 percent, and nobody noticed a minute of staleness.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- How would you purge the CDN when the underlying data changes?
- What is the difference between no-cache and no-store?
- How do you cache hashed static assets differently from API responses?
Related full stack developer questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions