API responses specify appropriate caching behavior

An API endpoint that returns product listings or blog posts without a Cache-Control header causes every client request to hit the origin server — even when the data hasn't changed in hours. At scale, this is avoidable server load that accumulates into real infrastructure cost and latency. Conversely, a user-specific endpoint (account data, cart, session) served with Cache-Control: public allows CDN or browser caching to serve one user's data to another — a privacy violation. ISO 25010 performance-efficiency.resource-utilization applies: public data should be cached to eliminate redundant computation; private data must be protected from shared caches.

Add explicit Cache-Control headers to all API GET routes. Public data (product lists, blog posts, public stats) should be cached; user-specific data (account info, cart, orders) must be marked private or uncacheable.

// Next.js App Router — src/app/api/products/route.ts
export async function GET() {
  const products = await db.products.findAll()
  return Response.json(products, {
    headers: {
      'Cache-Control': 'public, s-maxage=3600, stale-while-revalidate=86400'
      // CDN caches for 1 hour, serves stale for 24h while revalidating
    }
  })
}

// User-specific data — must be private
export async function GET(request: Request) {
  const user = await getAuthenticatedUser(request)
  return Response.json(user, {
    headers: {
      'Cache-Control': 'private, no-cache'
      // Never cache in shared (CDN) cache
    }
  })
}