< ETag: "33a64df5"

TL;DR: ETag is a version fingerprint for a response. Clients send it back as If-None-Match to get a bodiless 304 Not Modified, or as If-Match to refuse writes to a changed resource (412). If you never see 304, your ETags are unstable.

How it works

GET /app.css HTTP/1.1

HTTP/1.1 200 OK
Cache-Control: no-cache
ETag: "33a64df5"
Content-Length: 18240

Later, the client revalidates:

GET /app.css HTTP/1.1
If-None-Match: "33a64df5"

HTTP/1.1 304 Not Modified
ETag: "33a64df5"
Cache-Control: no-cache

The 304 has no body; the cache reuses its stored copy and updates the headers. The quotes are part of the value. Defined in RFC 9110 section 8.8.3 and used by caches per RFC 9111 section 4.3.

Strong and weak

ETag: "33a64df5"
ETag: W/"33a64df5"

Strong: byte-for-byte identical. Weak: equivalent for the application’s purposes. Comparison rules (RFC 9110 section 8.8.3.2): If-None-Match uses weak comparison, while If-Match and If-Range need strong. That means a weak ETag works for cache revalidation but cannot support safe writes or resuming a partial download.

Why gzip makes your ETag weak

When nginx compresses a response on the fly, it rewrites a strong ETag into a weak one (W/"...") because the compressed body is a different byte sequence. Apache’s mod_deflate historically appended -gzip to the tag ("33a64df5-gzip"), which broke If-None-Match matches on the uncompressed variant in some versions. Both are harmless for caching but defeat If-Range. Options: serve precompressed files (gzip_static on;, Brotli equivalents) with their own strong tags, or accept weak tags.

etag on;          # default for static files; derived from mtime and size
gzip_static on;   # serve app.css.gz as-is with a stable ETag

Generating ETags

• Hash of the content: stable across servers, costs CPU on dynamic content. Express generates weak ETags by default via app.set('etag', 'weak').
• Version or revision number from the database row: cheap and strong semantics for APIs ("v17").
• File mtime plus size (nginx default): fine on a single node. nginx’s format is "<mtime hex>-<size hex>".
• Avoid inode-based ETags behind a load balancer. Apache 2.4 defaults to FileETag MTime Size; if a config still enables INode (the old Apache 2.2 default), remove it and check that file modification times agree across nodes.

Optimistic concurrency with If-Match

PUT /api/docs/7 HTTP/1.1
If-Match: "v17"
Content-Type: application/json

{"title":"Updated"}

HTTP/1.1 412 Precondition Failed
ETag: "v18"

Someone else saved v18 first. Return 428 Precondition Required if you demand the header and it is missing. See If-Match, 412 and 428.

Debug “no 304”

curl -sI https://example.com/app.css | grep -i etag
curl -sI https://example.com/app.css | grep -i etag   # same value?
curl -si https://example.com/app.css -H 'If-None-Match: "33a64df5"' | head -1

If the value changes between calls, you are hitting different origins or a layer rewrites it. If it is stable but the second command returns 200, the server does not implement conditional handling or Vary differs. A CDN that does not forward If-None-Match to the origin can still answer 304 itself from its cache, and Cloudflare may drop strong ETags on compressed responses, so check cf-cache-status and compare ETags at the origin directly.

Also note an ETag does nothing for freshness; pair it with Cache-Control no-cache or max-age.

Related

• If-None-Match, If-Match, If-Range, Last-Modified, Vary
• 304 Not Modified and 304 vs 200