From the RFC 2616
If the no-cache directive does not specify a field-name, then a cache
MUST NOT use the response to satisfy a subsequent request without
successful revalidation with the origin server. This allows an origin
server to prevent caching even by caches that have been configured to
return stale responses to client requests.
When the must-revalidate directive is present in a response received
by a cache, that cache MUST NOT use the entry after it becomes stale
to respond to a subsequent request without first revalidating it with
the origin server
Though this directive sounds like it is instructing the browser not to
cache the page, there’s a subtle difference. The “no-cache” directive,
according to the RFC, tells the browser that it should revalidate with
the server before serving the page from the cache. Revalidation is a
neat technique that lets the application conserve band-width. If the
page the browser has cached has not changed, the server just signals
that to the browser and the page is displayed from the cache. Hence,
the browser (in theory, at least), stores the page in its cache, but
displays it only after revalidating with the server. In practice, IE
and Firefox have started treating the no-cache directive as if it
instructs the browser not to even cache the page. We started observing
this behavior about a year ago. We suspect that this change was
prompted by the widespread (and incorrect) use of this directive to
The must-revalidate directive ought to be used by servers if and only if failure to validate a request on the representation could result in incorrect operation, such as a silently unexecuted financial transaction.
I believe that
must-revalidate means "once the cache expires, refuse to return stale responses to the user even if they say that they are acceptable". Whereas
must-revalidate plus the fact the response becomes stale right away.
If a response is cacheable for 10 seconds, then
must-revalidate kicks in after 10 seconds, whereas
must-revalidate after 0 seconds.
At least, that's my interpretation.