Spring Security - No way to avoid cache-control

Question

I have an application and use a controller mapping of spring to load images to my users. (InputStream, response, etc).

In my controller I set headers to cache-control, baseaded on files, etc. But there's always pragma: no-cache and Cache-Control:"max-age=0" inside all requests, and that's replace my response settings.

I was trying everything to solve this, but nothing works.

I already read all page and try everything I found about that: http://docs.spring.io/autorepo/docs/spring-security/3.2.0.CI-SNAPSHOT/reference/html/headers.html

My spring security.xml has:

    <security:headers disabled="true"/>

Anyone have a good idea to solve this?

Remember that to load the images I need to load through my controller, I never call static directly.

Can you provide the code you use to set the headers in your controller? Does the problem still happen if you remove Spring Security entirely? — Rob Winch, Jul 14 '15 at 20:29

score 19 · Answer 1 · answered Apr 06 '16 at 18:18

19

The Cache-Control headers can be controlled on a per action basis by overriding them in the HttpServletResponse:

@RequestMapping(value = "/foo", method = RequestMethod.GET)
public String someAction(HttpServletResponse response) {
    response.setHeader("Cache-Control", "no-transform, public, max-age=86400");

    // ...
}

No need to fiddle with the Spring Security configuration.

See http://docs.spring.io/spring-security/site/docs/current/reference/html/headers.html#headers-cache-control.

answered Apr 06 '16 at 18:18

aha

3,702
3
38
47

This is the ONLY approach I found to work. Thank you very much! – BrianT. Apr 04 '17 at 15:18
Thank you so much. Your solution has saved a lot of time. – harshavmb Apr 21 '17 at 18:00
4

This will duplicate the header instead of overriding it. I am getting `no-cache, no-store, max-age=0, must-revalidate, max-age=7200` – Kumait Jul 29 '17 at 05:59
@Kumait Works with Spring 5.1.9 – cdalxndr Oct 09 '19 at 21:08

Grigory · Answer 2 · 2019-12-02T09:27:53.027

12

In case one uses Java based configuration, cache control headers can be disabled this way:

@Configuration
@EnableWebMvcSecurity
class SpringWebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(final HttpSecurity http) throws Exception {
        http.headers().cacheControl().disable();
    }
}

This will remove CacheControlHeadersWriter and Spring won't write cache control headers any more.

edited Dec 02 '19 at 09:27

answered Apr 05 '16 at 08:02

Grigory

465
5
16

Where do I put this config? – Felipe Ferreira do Amaral Apr 06 '16 at 14:21
Thanks for the answer. Works for me. – Felipe Ferreira do Amaral Apr 09 '16 at 14:06
4

Disabling default Spring security behavior is bad idea. You read more here: https://www.baeldung.com/spring-security-cache-control-headers – Piotr Kończak Aug 24 '18 at 12:09

ikumen · Answer 3 · 2015-07-14T17:41:02.580

0

Per Spring Security reference (3.2.0) you've linked to,

All of the default headers can be easily added using the element with no child elements

Simply adding headers by itself will turn on all child elements (e.g. cache control, xxs, ...). Either don't include headers at all or explicitly specify which child elements you want to enable.

BTW, I don't think disabled is an attribute of headers (for 3.2.0). If you're using version 4.0, there is a disabled attribute as well as disabled-defaults, which might be the one you want.

edited Jul 14 '15 at 17:41

answered Jul 14 '15 at 17:19

ikumen

11,275
4
41
41

Tryed now and not solve. I want to remove the "no-cache" of my requests, no include them. – Felipe Ferreira do Amaral Jul 14 '15 at 17:22
What did you try? Can you show what your updated config looks like. – ikumen Jul 14 '15 at 17:24
Sure, The config now is: – Felipe Ferreira do Amaral Jul 14 '15 at 17:51
For security version < 4.0, will turn on all default headers (including cache control). If you don't need any headers, just remove the . If you need some headers, then explicitly list them. If your security version is 4.0, then try adding the attribute `disabled-defaults="true"` – ikumen Jul 14 '15 at 18:05
I tried too, get out everything and it's the same. I don't need anything about that, but it keep no-cache in my app. – Felipe Ferreira do Amaral Jul 14 '15 at 18:21

score 0 · Answer 4 · answered Aug 04 '17 at 07:15

Adding to aha's answer. You also need to override the Pragma header with some garbage.

@RequestMapping(value = "/foo", method = RequestMethod.GET)
public String someAction(HttpServletResponse response) {
    response.setHeader("Cache-Control", "no-transform, public, max-age=86400");
    response.setHeader("Pragma", "");
    // ...
}

The Expires header also still shows in the response, but seems to be overridden by the Cache-Control header in most browsers.

score 0 · Answer 5 · answered Jan 31 '22 at 10:53

The below code should work for you in spring 5.X

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.headers()
        .defaultsDisabled()
        .cacheControl();
    }
}

score -1 · Answer 6 · answered Nov 15 '15 at 15:22

It has been sometime - but while researching on the same problem, I found this post and this worked or me -

disable caching for specific url in spring security

The beauty of the solution referred above is that it enables each header specifically using its original class, and uses antmatchers to align specific request paths to the respective header. In my case, I used a separate Cache reference for my static resources with cache expiry set and another one for all jsps with no cache. Since it is an ant matcher, the controller uri can be matched using the same approach.

Spring Security - No way to avoid cache-control

6 Answers6

Linked