Is Expires header not needed now?

Question

I see big player (i.e. akamai) started to drop the Expires header all together and only use Cache-Control, e.g.

curl -I https://fbcdn-sphotos-e-a.akamaihd.net/hphotos-ak-snc7/395029_379645875452936_1719075242_n.jpg

HTTP/1.1 200 OK
Last-Modified: Fri, 01 Jan 2010 00:00:00 GMT
Date: Sun, 25 Nov 2012 16:46:43 GMT
Connection: keep-alive
Cache-Control: max-age=1209600

So still any reason to keep using Expires?

See also http://stackoverflow.com/questions/12479581/does-cache-control-s-maxage-header-override-expires-header-for-browser-cache — Raedwald, Mar 29 '15 at 17:43

score 3 · Accepted Answer · edited Oct 07 '21 at 05:59

Cache-Control was introduced in HTTP 1.1 to replace Expires. If both headers are present, Cache-Control is preferred over Expires:

If a response includes both an Expires header and a max-age directive, the max-age directive overrides the Expires header, even if the Expires header is more restrictive. This rule allows an origin server to provide, for a given response, a longer expiration time to an HTTP/1.1 (or later) cache than to an HTTP/1.0 cache. This might be useful if certain HTTP/1.0 caches improperly calculate ages or expiration times, perhaps due to desynchronized clocks.

But there are still clients out there that can only HTTP 1.0. So for HTTP 1.0 requests/responses, you should still use Expires.

Is Expires header not needed now?

1 Answers1