Acidus wrote:
The RFCs are nice but dense. O'Reilly's "definitive" Guide to HTTP is woefully lacking solid information about caching. I had to dig into Squid to learn more about only-if-cache and sibling/child caches. There are many books out there that talk about HTTP caching from a performance point of view, but after Expires, LAst-Modified, and E-Tags they lose detail quickly. Shiflet's book looks interesting, and the parts I've seen on Google Books are no-nonsense and clear. Is that on your list?

A search on SafariBooksOnline for `must-revalidate' lists 69 books, 20 of which are O'Reilly books, 1 of which is Shiflett's book, and only 1 of which is an Addison-Wesley book worth mention (Refactoring HTML and I was kidding about it being better than yours). This includes section 7.9.4 in HTTP: The Definitive Guide. There is a blurb somewhere that covers caching for security purposes, although I can't remember what it is now -- and I guess it could have been in the Akamai documentation or similar.

Acidus wrote:
However some things are still unclear. Do modern caching proxies cache URLs with query strings? By default how excessive can they be? What about cookie assignments? Can I use Set-Cookie as a value in Cache-Control to force their caching? Which caches perform transforms and thus pay attention to no-transform? Will they modify the Content-MD5 header?

You were definitely in the right place with the Squid source code in order to answer these questions. I know that with reverse proxies, they will sometimes append query strings (but never cookies), which often times require mod_rewrite or similar on the server end to interpret properly. Of course a cache server in either direction can cache query strings, cookies -- anything unencrypted in the header is potentially unsafe. The only cache server that performs transforms by default that I know about is RabbIT (http://www.khelekore.org/rabbit/), although I guess the local proxy, webcleaner.sf.net probably does transforms, too. I don't think proxies should or will ever modify the Content-MD5 header, see: http://www.askapache.com/htaccess/speed-up-sites-with-htaccess-caching.html

I ran across UsaProxy about a year ago - http://fnuked.de/usaproxy/ - probably from ckers.org, and I saw it mentioned in the newish O'Reilly book, Website Optimization. There may be other ways to do whatever you are trying to do using methods such as found in a usability proxy.

RE: HTTP Caching is bretarded: Or, how I learn to stop worrying and accept that 'no-cache' actually does cache.