Squid 403 Responses: Fresh Denial or Cached Error?
Separate a fresh access denial from a cached negative response before changing Squid’s cache lifetime policy.
The same 403 page twice is not evidence of a cache hit. Match the transaction's access record and response headers to two questions: who produced the denial, and was a stored response reused?
- A locally denied request calls for its access-rule or identity decision to be corrected.
- A fresh origin denial means the origin still rejects the request.
- A reused origin response calls for its freshness policy and applicable cache configuration to be inspected.
HTTP caching includes some negative responses under its caching conditions, but 403 does not receive heuristic freshness by default. An otherwise cacheable denial can carry an explicit shared-cache lifetime. Changing permission at the origin does not erase a response still considered fresh; use appropriate response policy for decisions that should not be stored.
Squid's negative_ttl is a separate fallback for certain failed requests with unknown expiry. Its documented default is zero in the versions covered by the current directive reference. That does not prohibit error responses made fresh by explicit HTTP instructions.
The reference also requires a build allowing HTTP violations and excludes Squid 8. Do not transfer a Squid 2.7 lifetime suggestion to another release without checking support. Removing an object can clear an immediate symptom; the policy making it reusable determines the next request.