title: Disabling Spring Security headers does not work
body: <p>I need to disable the cache control headers in my Spring Security conf.</p>
  
  <p>According to the documentation a simple <code>http.headers.disable()</code> should do it, but I still see the</p>
  
  <pre><code>Cache-Control:no-cache, no-store, max-age=0, must-revalidate
  Expires:0
  Pragma:no-cache
  </code></pre>
  
  <p>headers in responses.</p>
  
  <p>My current security config is:</p>
  
  <pre><code>http.antMatcher("/myPath/**") // "myPath" is of course not the real path
      .headers().disable()
      .authorizeRequests()
       // ... abbreviated
      .anyRequest().authenticated();
  </code></pre>
  
  <p><strong>Things I've tried so far:</strong></p>
  
  <p><strong>application.properties</strong></p>
  
  <p>I added the <code>security.headers.cache=false</code> line, but that made no difference.</p>
  
  <p><strong>Using a filter</strong></p>
  
  <p>I tried the following filter:</p>
  
  <pre><code>@Override
  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    chain.doFilter(request, new HttpServletResponseWrapper((HttpServletResponse) response) {
        @Override
        public void setHeader(String name, String value) {
          if (name.equalsIgnoreCase("Cache-Control")) {
            value = "";
          } else if (name.equalsIgnoreCase("Expires")) {
            value = "";
          } else if (name.equalsIgnoreCase("Pragma")) {
            value = "";
          }
          super.setHeader(name, value);
        }
    });
  }
  </code></pre>
  
  <p>After adding logging I saw that this filter only writes the <code>X-XSS-Protection</code> header, all the cache headers are written somewhere later and this filter doesn't have access to "override" them. This happens even if I add this filter at the last position of the security filter chain.</p>
  
  <p><strong>Using an interceptor</strong></p>
  
  <p>I tried the following interceptor:</p>
  
  <pre><code>@Override
  public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
      String requestUri = request.getRequestURI();
      response.setHeader("Cache-Control", "max-age=3600");
      response.setHeader("Expires", "3600");
      response.setHeader("Pragma", "");
  }
  </code></pre>
  
  <p>This (quite predictably) just added the headers, meaning that the original <code>no-cache</code> headers still appear in addition to the ones added by the interceptor.</p>
  
  <p>I'm at my wits end here. How do I get rid of the cache control header set by Spring security?</p>