How to add Cache-Control header to static resource in Spring Boot?

Question

How can I add Cache-Control HTTP header in Spring Boot for static resources?

Tried using a filter-component in the application, which writes headers correctly, but Cache-Control header gets overwritten.

@Component
public class CacheBustingFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
    }

    @Override
    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) 
                                              throws IOException, ServletException {

        HttpServletResponse httpResp = (HttpServletResponse) resp;
        httpResp.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
        httpResp.setHeader("This-Header-Is-Set", "no-cache, no-store, must-revalidate");
        httpResp.setHeader("Expires", "0");

        chain.doFilter(req, resp);
    }

What I get in the browser is:

Cache-Control:no-store
This-Header-Is-Set:no-cache, no-store, must-revalidate
Expires:0

What I would like is:

Cache-Control:no-cache, no-store, must-revalidate
This-Header-Is-Set:no-cache, no-store, must-revalidate
Expires:0

http://stackoverflow.com/questions/24164014/how-to-enable-http-response-caching-in-spring-boot — Anton N, Oct 19 '15 at 13:15
Tried that also, didn't work. It adds X-headers and various stuff. But Cache-Control is always "no-store". — MatteKarla, Oct 19 '15 at 13:44

score 20 · Answer 1 · answered Feb 25 '16 at 23:32

This happens because of Spring Security: it rewrites all cache headers to disable caching totally. So we need to do two things:

Disable spring security for static resources
Enable static resource cache processing

In current version of Spring Boot we can change this behavior in application.properties config.

Disable spring security for some resources:

# Comma-separated list of paths to exclude from the default secured 
security.ignored=/myAssets/**

Enable sending cache headers for static resources:

# Enable HTML5 application cache manifest rewriting.
spring.resources.chain.html-application-cache=true

# Enable the Spring Resource Handling chain. Disabled by default unless at least one strategy has been enabled.
spring.resources.chain.enabled=true
# Enable the content Version Strategy.
spring.resources.chain.strategy.content.enabled=true 
# Comma-separated list of patterns to apply to the Version Strategy.
spring.resources.chain.strategy.content.paths=/** 

# Locations of static resources.
spring.resources.static-locations=classpath:/META-INF/resources/,classpath:/resources/,classpath:/static/,classpath:/public/

That's all. Now Spring will check if your static files was changed and can send smarter responses (If-Modiffied-Since and others) and rewrite your appcache also.

Also, if there are reasons to not use content-based version for some resources - you can use alternate FixedVersion strategy and set version explicitly in your config:

#Enable the fixed Version Strategy.
spring.resources.chain.strategy.fixed.enabled=false 
# Comma-separated list of patterns to apply to the Version Strategy.
spring.resources.chain.strategy.fixed.paths= 
# Version string to use for the Version Strategy.
spring.resources.chain.strategy.fixed.version=

See more in docs

No, it does not need to turn off spring security. See https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#headers-cache-control — kidnan1991, Aug 06 '18 at 12:37
Just for information `spring.resources.chain.html-application-cache` is deprecated since Spring Boot 2.4.0-M3: https://github.com/spring-projects/spring-boot/issues/23228 — RiZKiT, Apr 07 '22 at 14:04

Maleen Abewardana · Accepted Answer · 2015-10-19T13:58:42.847

17

As per the documentation, of ResourceHandlerRegistry. It is pretty easy. (I have no code related to it right now.)

In the place where you configure your static resources just add addResourceHandler method, It will return ResourceHandlerRegistration object.

There you can use setCacheControl method. What you have to do is configure and set a CacheControl obejct.

This is since spring 4.2, else you will have to do it like below.

@Configuration
@EnableWebMvc
@ComponentScan("my.packages.here")
public class WebConfig extends WebMvcConfigurerAdapter {


   @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        registry.addResourceHandler("/resources/**").setCachePeriod(0);
    }

}

edited Oct 19 '15 at 13:58

answered Oct 19 '15 at 13:47

Maleen Abewardana

13,600
4
36
39

1

Setting CacheControl object with setCacheControl() makes the server send the correct headers, verified with `curl -I` – MatteKarla Oct 20 '15 at 06:24
I couldn't find any code samples of the CacheControl object and setCacheControl, could you please share how you did this? Thanks! – Raul G Jun 09 '16 at 04:25
2

Actually, you shouldn't use @EnableWebMvc. It caused me lot of time to figure out what happens, because some pages weren't served. See http://stackoverflow.com/a/27383522/4252764 – Vuk Djapic Apr 28 '17 at 06:44
4

If you're using Spring Boot, just use `spring.resources.cache-period` and make sure you configure Spring Security to ignore the static resources https://stackoverflow.com/questions/36835420/set-setcacheperiod-for-static-resources-in-spring-boot – Dec 26 '17 at 17:05

score 9 · Answer 3 · answered Aug 27 '18 at 13:16

9

The are properties that control the default cache headers for resources:

spring.resources.cache.cachecontrol.max-age: 3600

https://docs.spring.io/spring-boot/docs/current/reference/html/common-application-properties.html

answered Aug 27 '18 at 13:16

Mateusz Stefek

3,478
2
23
28

1

That works for static resources including index.html. How would I prevent the server from setting the header, when index.html is requested (but set it on requests for all other static resources)? – dagerber Aug 29 '18 at 13:10
@dagerber do you still need this requirement? I figured it out. – Merv Jan 12 '19 at 14:57

Merv · Answer 4 · 2019-01-13T04:36:14.893

There are a lot of ways in spring boot for caching http resource. Using spring boot 2.1.1 and additionally spring security 5.1.1.

1. For resources using resourcehandler in code (UNTESTED):

You can add customized extensions of resources this way.

registry.addResourceHandler

Is for adding the uri path where to get the resource

.addResourceLocations

Is for setting the location in the filesystem where the resources are located( given is a relative with classpath but absolute path with file::// is also possible.)

.setCacheControl

Is for setting the cache headers (self explanatory.)

Resourcechain and resolver are optional (in this case exactly as the default values.)

@Configuration
public class CustomWebMVCConfig implements WebMvcConfigurer {

@Override
public void addResourceHandlers(ResourceHandlerRegistry registry) {
    registry.addResourceHandler("/**")
            .addResourceLocations("classpath:/static/")
            .setCacheControl(CacheControl.noStore()
                    .mustRevalidate())
            .setCacheControl(CacheControl.noCache())
            .resourceChain(true)
            .addResolver(new PathResourceResolver());
    }
}

2. For resources using application properties config file

Same as above, minus the specific patterns, but now as config. This configuration is applied to all resources in the static-locations listed.

spring.resources.cache.cachecontrol.no-store=true
spring.resources.cache.cachecontrol.must-revalidate=true
spring.resources.cache.cachecontrol.no-cache=true

3. At controller level

Response here is the HttpServletResponse injected in the controller method as parameter.

response.setHeader(HttpHeaders.CACHE_CONTROL,
            "no-cache, must-revalidate, no-store");
response.setHeader("Expires", "0");

score 4 · Answer 5 · answered Mar 10 '21 at 12:18

I want to add some useful comments to the given answers which use @Override public void addResourceHandlers(ResourceHandlerRegistry registry) {} because I had some problems with it. They may be useful for others too.

Assuming the following directory structure of a default Spring Boot 2.4 application with Spring Web MVC.

src/main/resources/
|- static/
  |- res/
    |- css/
    |- js/
  |- images/
  |- favicon.ico

And we want to add caching for css, js, images and favicon. Then a Configuration would look like this:

import org.springframework.boot.autoconfigure.web.WebProperties;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.CacheControl;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

import java.util.concurrent.TimeUnit;

@Configuration
public class CacheStaticResourcesConfiguration implements WebMvcConfigurer {

    /**
     * We provide a custom configuration which resolves URL-Requests to static files in the
     * classpath (src/main/resources directory).
     *
     * This overloads a default configuration retrieved at least partly from
     * {@link WebProperties.Resources#getStaticLocations()}.
     * @param registry ResourceHandlerRegistry
     */
    @Override
    public void addResourceHandlers(final ResourceHandlerRegistry registry) {
        /*
         * BE AWARE HERE:
         *
         * .addResourceHandler(): URL Paths
         * .addResourceLocations(): Paths in Classpath to look for file
         *   root "/" refers to src/main/resources
         *   For configuration example, see:
         *     org.springframework.boot.autoconfigure.web.WebProperties.Resources().getStaticLocations()
         *
         * .addResourceLocations("classpath:/static/")
         *   =>
         *      addResourceHandler("/**")
         *      => GET /res/css/main.css
         *         => resolved as: "classpath:/static/res/css/main.css"
         *      BUT
         *      addResourceHandler("/res/**")
         *      => GET /res/css/main.css
         *            (spring only appends the ** to the value from
         *             addResourceLocations())
         *         => resolved as: "classpath:/static/css/main.css"
         */

        registry
                .addResourceHandler("/favicon.ico")
                .addResourceLocations("classpath:/static/")
                .setCacheControl(CacheControl.maxAge(1, TimeUnit.DAYS)
                        .noTransform()
                        .mustRevalidate());

        registry
                .addResourceHandler("/res/**")
                // trailing slash is important!
                .addResourceLocations("classpath:/static/res/")
                .setCacheControl(CacheControl.maxAge(7, TimeUnit.DAYS)
                        .noTransform()
                        .mustRevalidate());

        registry
                .addResourceHandler("/images/**")
                // trailing slash is important!
                .addResourceLocations("classpath:/static/images/")
                .setCacheControl(CacheControl.maxAge(7, TimeUnit.DAYS)
                        .noTransform()
                        .mustRevalidate());
    }

}

score 2 · Answer 6 · edited Jan 13 '17 at 16:38

Maleenc's, answer is correct. However, there is one issue with this implementation.

The following code will provide the correct cache-control header on the first request, but not a future request that returns 304 (Not-Modified) will return the default cache-control header set by spring security. {code}

public void addResourceHandlers(ResourceHandlerRegistry registry) {         
    registry.addResourceHandler("/resources/**").setCacheControl(CacheControl.maxAge(10, TimeUnit.SECONDS));
}

I have raised up this issue to the spring team, see https://jira.spring.io/browse/SPR-15133. Here was there response: "Now you shouldn't disable security cache-control headers for your whole application indeed; the proper way to disable those for a specific path (resource handling, here) is explained in that issue comment, see the "Workaround" section."

score 2 · Answer 7 · answered Mar 01 '17 at 14:55

Using spring boot 1.3.3, I had a 404 answer using maleenc answer. I could correct it by adding a resource location:

@Configuration
public class HttpClientConfiguration extends WebMvcConfigurerAdapter {
    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        registry.addResourceHandler("/**").setCacheControl(CacheControl.maxAge(1, TimeUnit.DAYS))
                .addResourceLocations("/");
    }
}

score 0 · Answer 8 · answered Oct 05 '20 at 07:57

We can also add Cache-Control header in interceptors:

@Override
public void addInterceptors(InterceptorRegistry registry) {
    WebContentInterceptor interceptor = new WebContentInterceptor();
    interceptor.addCacheMapping(CacheControl.maxAge(60, TimeUnit.SECONDS)
      .noTransform()
      .mustRevalidate(), "/static/**");
    registry.addInterceptor(interceptor);
}

Then we don't have to specify resource locations.

https://www.baeldung.com/spring-mvc-cache-headers#cache-interceptors

This doesn't seem to work on static files for me, only on my non-spring security protected dynamic content. — goat, Sep 07 '21 at 21:04

How to add Cache-Control header to static resource in Spring Boot?

8 Answers8

Linked