{"question":"When may a shared cache store a response to a request that carried an Authorization header field?","state":"grounded","http_status":200,"index_version":"0fc1763d6701","answer":"Under rfc9111#3, a shared cache must not store a response to a request with an Authorization header field unless a response directive is present that explicitly allows shared caching, along with the other storage requirements in that section. [rfc9111#3] Under rfc9111#3.5, the Cache-Control response directives identified as allowing a shared cache to store and later use a response to a request with an Authorization header field are must-revalidate, public, and s-maxage, provided the cache conforms to the requirements of the applicable directive for that response. [rfc9111#3.5] Under rfc9111#5.2.2.9, the public response directive explicitly marks a response as cacheable and permits a shared cache to reuse a response to a request containing an Authorization header field, subject to the constraints in Section 3. [rfc9111#5.2.2.9]","message":"","citations":["rfc9111#3","rfc9111#3.5","rfc9111#5.2.2.9"],"supported":[{"text":"Under rfc9111#3, a shared cache must not store a response to a request with an Authorization header field unless a response directive is present that explicitly allows shared caching, along with the other storage requirements in that section.","citation":"rfc9111#3","coverage":0.8},{"text":"Under rfc9111#3.5, the Cache-Control response directives identified as allowing a shared cache to store and later use a response to a request with an Authorization header field are must-revalidate, public, and s-maxage, provided the cache conforms to the requirements of the applicable directive for that response.","citation":"rfc9111#3.5","coverage":0.6957},{"text":"Under rfc9111#5.2.2.9, the public response directive explicitly marks a response as cacheable and permits a shared cache to reuse a response to a request containing an Authorization header field, subject to the constraints in Section 3.","citation":"rfc9111#5.2.2.9","coverage":0.9444}],"withdrawn":[],"consulted":[{"section_id":"rfc9111#3.5","citation":"RFC 9111 Section 3.5: Storing Responses to Authenticated Requests","rank":1,"score":0.7847},{"section_id":"rfc9111#3","citation":"RFC 9111 Section 3: Storing Responses in Caches","rank":2,"score":0.6713},{"section_id":"rfc9111#4","citation":"RFC 9111 Section 4: Constructing Responses from Caches","rank":3,"score":0.636},{"section_id":"rfc9111#5.2.2.9","citation":"RFC 9111 Section 5.2.2.9: public","rank":5,"score":0.6116},{"section_id":"rfc9110#16.4.2","citation":"RFC 9110 Section 16.4.2: Considerations for New Authentication Schemes","rank":6,"score":0.611},{"section_id":"rfc9111#3.2","citation":"RFC 9111 Section 3.2: Updating Stored Header Fields","rank":7,"score":0.6071},{"section_id":"rfc9110#11.6.2","citation":"RFC 9110 Section 11.6.2: Authorization","rank":8,"score":0.6067},{"section_id":"rfc9111#7.3","citation":"RFC 9111 Section 7.3: Caching of Sensitive Information","rank":10,"score":0.5906}],"budget":{"deadline_ms":150.0,"elapsed_ms":1.039,"exceeded":false,"stages":{"retrieval":0.424,"drafting":0.005,"grounding":0.593}}}