A cache exists to trade a network round trip for a conditional one. On the first request, the server's response carries its own expiration policy: max-age says how long the body is authoritative, ETag and Last-Modified give it a fingerprint. Every later request is a decision at the cache: is the stored copy still fresh? Then serve it and touch nothing. Stale? Then revalidate with a conditional GET.
The clever part is what a 304 means: the body was never retransmitted — only headers. Stale metadata gets refreshed, the cached body stays, and the next request is a hit again. That is why ordering matters: validators are compared first, and only a mismatch triggers a full download. When freshness is ambiguous or absent, the browser falls back to heuristics, and when the server says no-store, the cache surrenders entirely — correctness beats bandwidth every time.