We're currently reviewing our set of "no-cache" security headers:
Cache-Control "no-cache, no-store, must-revalidate
Besides the "standard" set above, I found this article, recommending to combine "no-cache" and "no-store" with "private". As far as I understand the specification it should be sufficient to set "no-cache" and "no-store" if you want to forbid caching at all.
So my question: Are there any reasons to add the "private" header to our set? And if so, will there be a conflict between the headers?
P.S.: I also checked the following two discussions, which did not provide a definite answer.