HTTP Caching Headers: private vs no-cache

We’re currently reviewing our set of “no-cache” security headers: Cache-Control “no-cache, no-store, must-revalidate Pragma “no-cache” Expires 0 Besides the “standard” set above, I found this article, recommending to combine “no-cache” and “no-store” with “private”. As far as I understand the specification it should be sufficient to set “no-cache” and “no-store” if you want to forbid caching …

https://security.stackexchange.com/questions/95877/http-caching-headers-private-vs-no-cache