Choose no-store when Cloudflare must not retain a sensitive response

No-cache and no-store are different instructions, especially when Origin Cache Control is enabled.

Source facts

Cloudflare documents no-store as prohibiting storage of the request or response. No-cache instead requires validation before reuse and can allow cached storage when Origin Cache Control is enabled. Cache Rules can augment or override origin behavior, so the origin header is only part of the effective configuration. Private responses are intended for a single user rather than a shared cache.

Source: Cloudflare — Origin Cache Control.

Applicability

This concerns Cloudflare response caching directives.

DSE recommendation

DSE recommends classifying authenticated, personalized, and public responses before adjusting cache policy. Use the storage restriction that matches the data-handling requirement and review matching Cache Rules for overrides. Keep browser caching and shared-edge caching decisions explicit. Avoid using no-cache as a synonym for never stored, and do not broaden a cache rule to fix performance without checking cookies and user-specific content. For each sensitive response class, ask the application owner to approve the intended storage behavior in plain language. Include a signed-out request after a signed-in request in the isolated test sequence, and make any cross-session content reuse an immediate stop condition for the proposed policy.

Verification

With authorized test accounts, inspect origin and proxied response headers and the effective cache behavior across repeated requests. Compare anonymous and signed-in responses using separate sessions. Confirm sensitive content is not reused between users, and retain the rule configuration with the observations instead of treating a single MISS as proof of permanent non-storage.

Official reference

Cloudflare — Origin Cache Control. Reviewed October 20, 2026.