Default cache-control directives (and behaviour) when header returns only private

Question

I just checked the cache-control header returned by webmasters.stackexchange.com. The only directive present in the response is cache-control: private. In this case, what are the default values for other directives including max-age? Should a client re-validate (checking if the content is modified on the server) for every request?

Answer 1

Mozilla has a HTTP Caching FAQ that says:

[In this case] then the expiration calculation is essentially the algorithm described in RFC 2616 section 13.2.

...

The expiration time is computed as follows:

expirationTime = responseTime + freshnessLifetime - currentAge

where responseTime is the time at which the response was received according to the browser.

...

The freshness lifetime is calculated based on several headers. ... If [neither max-agenor Expires header are] present, then we look for a Last-Modified header. If this header is present, then the cache's freshness lifetime is equal to the value of the Date header minus the value of the Last-modified header divided by 10.

When I investigated this heuristic of Last-modified / 10 for Why is this response being cached?, I found that all major browsers appear to use this same heuristic.

According to Cache-Control - HTTP | MDN, clients must only revalidate if one of the following headers is present:

• no-cache
• max-age=0, must-revalidate

Since neither of those headers are present in this case, no revalidation needs to occur.