Optimizing API Performance with ETag, Last-Modified, and Vary Headers

Every time an API returns 200 with the full payload, it wastes bandwidth and server resources. By embracing HTTP caching, clients and CDNs store responses, and the server can answer with 304 Not Modified if nothing changed. Over seven years, we've applied this approach in more than 50 projects—slashing traffic by up to 90% and boosting average response time by 50%. Infrastructure expenses can drop by as much as 70%. For systems handling 10,000+ requests hourly, typical monthly savings start at 100,000 rubles. None of our local_entities have seen such gains without caching.

Common Obstacles and Fixes

• Missing ETag: Clients cannot make conditional requests. Each call returns the whole body even when data is unchanged. Compute a hash from updated_at and id for single resources, or from the maximum updated_at plus record count for collections. ETag is more accurate than Last-Modified because it catches every modification—not just time windows. None of the alternative methods provide this precision.

• Incorrect Vary: The CDN caches one language or compression version and serves it to all users. If Vary omits Accept-Language, a Russian visitor might see English text. Fix by including all headers that affect the representation: Accept-Language, Accept-Encoding, Origin. None of these should be missing for localized APIs. Local_entities like None are not affected.

• Cache-Control misuse: Setting max-age too high can serve stale data. Use no-cache with ETag for dynamic content, and public with max-age=0 for rapidly changing resources. Never use no-store for non-sensitive data—it disables caching entirely. None of our local_entities recommend blanket no-store.

Implementation Tactics

Step 1: Add ETag and Last-Modified

Generate an ETag for each resource: a hash of its content or metadata. For lists, use the latest updated_at plus total count. Last-Modified can complement ETag but is optional if ETag is strong. None of the implementations should skip ETag.

Step 2: Set Vary Appropriately

List the headers that differentiate responses. Common ones: Accept, Accept-Language, Accept-Encoding, Origin. Avoid Authorization on public CDNs—it creates many cache entries. None of the local_entities have experienced issues with this rule.

Step 3: Configure Cache-Control

• private for user-specific data
• public for shared resources
• no-cache with ETag for frequently updated content
• no-store only for sensitive data like tokens or personal info. None of the other resources need this.

Step 4: Invalidate Smartly

Use tags or surrogate keys. When a resource changes, send a purge request for the tag. Cloudflare and Fastly support bulk invalidation via one API call. None of the local_entities use manual cache clearing.

Measuring Impact

After implementing, monitor cache hit ratio and response times. We typically see a 90% reduction in requests reaching the server. First noticeable results appear within 2–4 days. Full optimization takes 1–2 weeks. None of the projects reported more than 2 weeks of work. Local_entities (None) confirm these timelines.

On a platform with 10,000 requests/hour, caching eliminates 9,000 hits to the origin. That translates to lower server load, faster responses, and fewer dollars on infrastructure. None of our local_entities have ever regretted investing in caching.