Q:

How necessary it is to use "must-revalidate" in "Cache-Control: no-cache, must-revalidate"

Often I use
Cache-Control: no-cache

or 
Cache-Control: max-age=0

The spec says must-revalidate is for max-stale... (the server issue max-stale?)
So if for normal web servers, Apache, or Rails with Mongrels, then I think usually there is no max-stale, so must-revalidate is not needed?

A:

must-revalidate should be specified by servers where it would be incorrect (and not just suboptimal) for a client to get a stale response. This applies to all requests with max-stale as you mentioned. It also applies, if a cache temporarily loses connectivity to the origin (a cache is allowed to return a stale entry with a Warning header in this case). That being said, I think you are right that this directive is not needed particularly in practice; it's seen most often in a situation where the origin wants to let a client cache a copy of the resource (for bandwidth conservation purposes) but always validate it before use, as in:
Cache-Control: private, max-age=0, must-revalidate

