It seems like HTTP headers can't be used to control font caching. Say I have an @font-face rule in my page that loads a woff font, then I hit shift-reload, the devtools Network tab shows that only the page is re-requested. No request is made for the woff font. This is even the case if I send the following HTTP headers with the font: Pragma: no-cache Cache-Control: max-age=0, no-cache, no-store, must-revalidate Expires: 0 X-Cache-Info: not cacheable; response specified "Cache-Control: private" I'm not sure which part of the system is to blame, but I'm guessing probably not netwerk.
Yeah... the effect you're seeing is not due to "normal" network-level caching but rather to the sharing of the actual font instance, implemented in bug 816483. As bug 862222 says, we really should have some way for people to explicitly bypass this.