HTTP Working Group Dat Vo Internet-Draft CETAN Intended status: Standards Track 20 October 2026 Expires: 23 April 2027 The 'session' Cache-Control Response Directive draft-dat-session-cache-control-00 Abstract This document defines a new HTTP Cache-Control response directive, "session", which specifies that a response may be cached only for the lifetime of the user agent's current browsing context. The directive enables ephemeral, non-persistent, and non-shared caching behavior suitable for modern web applications. The "session" directive is backward compatible with existing HTTP caches and is ignored by implementations that do not recognize it. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 23 April 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. Vo Expires 23 April 2027 [Page 1] Internet-Draft 'session' Cache-Control Directive October 2026 This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Requirements Language . . . . . . . . . . . . . . . . . . . . 3 3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 4. The 'session' Cache-Control Directive . . . . . . . . . . . . 3 4.1. Directive Definition . . . . . . . . . . . . . . . . . . 4 4.2. User Agent Requirements . . . . . . . . . . . . . . . . . 4 4.3. Interaction With Other Cache-Control Directives . . . . . 4 4.3.1. Unknown Directive Handling . . . . . . . . . . . . . 4 4.3.2. With 'no-store' . . . . . . . . . . . . . . . . . . . 4 4.3.3. With 'no-cache' . . . . . . . . . . . . . . . . . . . 5 4.3.4. With 'max-age' or 's-maxage' . . . . . . . . . . . . 5 5. Intermediary Cache Behavior . . . . . . . . . . . . . . . . . 5 6. Security Considerations . . . . . . . . . . . . . . . . . . . 5 7. Privacy Considerations . . . . . . . . . . . . . . . . . . . 5 8. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 6 8.1. Basic Session Caching . . . . . . . . . . . . . . . . . . 6 8.2. Backward-Compatible Deployment . . . . . . . . . . . . . 6 8.3. With Additional Directives . . . . . . . . . . . . . . . 6 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6 10. Appendix A: Use Cases . . . . . . . . . . . . . . . . . . . . 6 11. Normative References . . . . . . . . . . . . . . . . . . . . 7 Appendix A. Author's Address . . . . . . . . . . . . . . . . . . 7 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 7 1. Introduction HTTP caching semantics historically focus on time-based or shared- cache behavior using directives such as "max-age", "no-cache", "no- store", "private", and "immutable". These directives do not provide a mechanism for caching responses only for the duration of a user agent's browsing context (e.g., a single tab or window). Vo Expires 23 April 2027 [Page 2] Internet-Draft 'session' Cache-Control Directive October 2026 Modern web applications frequently operate within well-defined, ephemeral interaction contexts. These applications benefit from caching behavior that persists only for the lifetime of the browsing context, avoids unnecessary revalidation, avoids long-term persistence, avoids cross-context reuse, and improves performance without weakening privacy. The "session" directive addresses this need by defining a new caching scope: the browsing context. Responses marked with "session" may be stored in a user agent's memory cache and reused within the same browsing context, but MUST NOT be persisted or shared beyond it. This directive is designed to be backward compatible. User agents and intermediaries that do not recognize "session" will ignore it and apply existing caching semantics. 2. Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC8174] when, and only when, they appear in all capitals, as shown here. 3. Terminology Browsing Context: A conceptual environment in which a user agent presents a document to the user. Examples include a browser tab, window, or similar isolated presentation context. Session Cache: A user agent's ephemeral, memory-only cache associated with a single browsing context. Entries in the session cache MUST NOT persist beyond the lifetime of the browsing context. User Agent: Software that acts on behalf of a user to initiate HTTP requests and process HTTP responses. Intermediary Cache: A cache that is not part of the user agent, such as a CDN, forward proxy, or reverse proxy. Cache-Control Directive: A token appearing in the Cache-Control header field that defines caching behavior for HTTP responses. 4. The 'session' Cache-Control Directive Vo Expires 23 April 2027 [Page 3] Internet-Draft 'session' Cache-Control Directive October 2026 4.1. Directive Definition The "session" directive is a Cache-Control response directive with the following syntax: Cache-Control: session 4.2. User Agent Requirements A user agent that recognizes the "session" directive: 1. MUST treat the response as cacheable only within the current browsing context. 2. MUST store the response only in ephemeral memory. 3. MUST NOT write the response to persistent storage. 4. MUST NOT share the cached response across browsing contexts. 5. MUST NOT reuse the cached response after the browsing context ends. 6. MUST NOT revalidate the response during the lifetime of the browsing context. 7. MAY evict the response at any time for resource management purposes. 4.3. Interaction With Other Cache-Control Directives 4.3.1. Unknown Directive Handling User agents and intermediaries that do not recognize "session": MUST ignore it. MUST apply all other directives normally. 4.3.2. With 'no-store' Cache-Control: no-store, session "no-store" MUST take precedence. The response MUST NOT be cached. Vo Expires 23 April 2027 [Page 4] Internet-Draft 'session' Cache-Control Directive October 2026 4.3.3. With 'no-cache' Cache-Control: no-cache, session User agents that recognize "session" MUST apply "session" semantics. User agents that do not recognize "session" MUST apply "no-cache". 4.3.4. With 'max-age' or 's-maxage' Cache-Control: session, max-age=600 User agents MUST treat "session" as the primary directive. User agents MAY use "max-age" as an optional intra-session expiry. Intermediary caches MUST ignore "session" and apply "max-age" or "s-maxage" normally. 5. Intermediary Cache Behavior 1. MUST ignore the "session" directive unless they implement explicit support for session-scoped caching. 2. MUST NOT infer session semantics without a standardized mechanism for identifying session boundaries. 3. MUST continue to apply all other Cache-Control directives normally. 4. MAY implement session-scoped caching in the future if a standardized mechanism becomes available. 6. Security Considerations The "session" directive introduces no new HTTP semantics outside caching. Implementations MUST ensure that session-cached responses are not written to persistent storage, not shared across browsing contexts, and cleared when the browsing context ends. 7. Privacy Considerations The "session" directive improves privacy by ensuring that responses are cached only in ephemeral memory, do not persist beyond the browsing context, and are not shared across contexts or profiles. User agents MUST ensure that session-cached responses cannot be recovered after the browsing context ends. Vo Expires 23 April 2027 [Page 5] Internet-Draft 'session' Cache-Control Directive October 2026 8. Examples 8.1. Basic Session Caching HTTP/1.1 200 OK Cache-Control: session Content-Type: application/javascript 8.2. Backward-Compatible Deployment HTTP/1.1 200 OK Cache-Control: no-cache, session Content-Type: text/html 8.3. With Additional Directives HTTP/1.1 200 OK Cache-Control: session, max-age=300 Content-Type: application/json 9. IANA Considerations This document registers the following Cache-Control directive in the "HTTP Cache Directive Registry": Name: session Status: standard Reference: this document Description: Indicates that the response may be cached only for the lifetime of the browsing context and MUST NOT be persisted or shared beyond it. 10. Appendix A: Use Cases Single-page applications (SPAs) Authenticated dashboards Privacy-sensitive applications Web IDEs and tools Ephemeral web sessions Temporary access portals Vo Expires 23 April 2027 [Page 6] Internet-Draft 'session' Cache-Control Directive October 2026 11. Normative References [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", RFC 8174, BCP 14, May 2017, . Appendix A. Author's Address Dat Vo CETAN Email: dat.vo@cetan.io Author's Address Dat Vo CETAN Arlington, TX United States of America Email: dat.vo@cetan.io Vo Expires 23 April 2027 [Page 7]