A request carries an Authorization header field and the response carries only Cache-Control: max-age=600. May a shared cache reuse that stored response for a later request?
Yes, provided the later request carries identical Authorization credentials
Yes, max-age is explicit freshness information and settles the matter
No, a shared cache may never store a response to an authenticated request under any directive
No, unless the response carries a directive such as public, must-revalidate, or s-maxage✓Bonne réponse
Explication
max-age alone is not one of the directives that unlocks shared caching of an authenticated request; the caching spec names must-revalidate, public, and s-maxage as having that effect. Matching credentials on the later request is not part of the rule, because Vary does not track Authorization.