A cache does not re-download a document every time it wants to know whether its copy is current. Instead it sends a validator back to the origin and lets the origin answer with a small 304 Not Modified, or with the new body. Validation is the second half of HTTP caching, and validators are the keys that make it cheap.

A validator is a currentness answer you can compare

A validator is metadata that changes when the representation changes. HTTP defines two families:

  • Strong validators (ETag) identify a specific version of the bytes. Comparing them is reliable.
  • Weak validators (Last-Modified) are timestamps with second granularity; they can miss two writes in the same second.

An origin should send at least one validator. Caddy serves files with both ETag and Last-Modified by default, so the public edge of this site returns both:

etag: "dkx84jwth7nkc9e"
last-modified: Mon, 24 Aug 2026 13:55:23 GMT

Conditional requests trade a header for a possible 304

A client asks with If-None-Match (or a validator it already holds) and the origin compares it to the current one. When they match, the origin confirms it without resending the body:

$ curl -s -o /dev/null -w 'HTTP %{http_code}\n' -H 'If-None-Match: dkx84jwth7nkc9e' https://www.xbcatm.com/
HTTP 304
$ # size_download == 0 on a revalidation hit

When they differ, or no validator was sent, the origin answers 200 with the fresh body. A 304 is not a failure: it is the cheaper way to say the cached copy is still valid.

Strong and weak are not interchangeable

Use the strong ETag for conditional GET so the comparison is authoritative. Weak validators only promise that a body has stayed semantically similar, which is why range requests prefer strong ones. The http-range-requests note covers byte selection; this note covers “is my stored copy still the answer”.

What changes when you republish

When the tree changes, the ETag for a page changes too, so caches that revalidate fetch the new body. If a release updates bytes without touching Last-Modified, the ETag still catches the change, which is why the release manifest records byte checksums rather than only file mtimes.

Sources