title: Google App Engine adding cache-control and other headers
body: <p>I have a Flask application on Google App Engine and I want to tell browsers to cache a response that uses the <code>Cache-Control</code> header. It works as expected on <code>dev_appserver.py</code> but when deployed to App Engine the headers are modified and break the cache header.</p>
  <p>Here is the Flask view in particular:</p>
  <pre><code>@app.route(&quot;/resource&quot;)
  def resource():
      response = make_response(render_template(&quot;resource.html&quot;))
      response.headers['Cache-Control'] = &quot;max-age=31536000&quot;
      logging.error(&quot;HEADERS: {}&quot;.format(response.headers))
      return response
  </code></pre>
  <p>The logs for both development server and App Engine show:</p>
  <pre><code>Content-Type: text/html; charset=utf-8
  Content-Length: 112628
  Cache-Control: max-age=31536000
  </code></pre>
  <p>When I run it with the development app server it works as expected, as you can see from the headers below.</p>
  <p>When I open Chrome's development tools the headers for App Engine are:</p>
  <pre><code>alternate-protocol:443:quic
  cache-control:no-cache, must-revalidate
  content-encoding:gzip
  content-length:19520
  content-type:text/html; charset=utf-8
  date:Wed, 22 Jan 2014 19:53:47 GMT
  expires:Fri, 01 Jan 1990 00:00:00 GMT
  pragma:no-cache
  server:Google Frontend
  set-cookie:session=; expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Path=/
  status:200 OK
  strict-transport-security:max-age=31536000
  vary:Accept-Encoding
  version:HTTP/1.1
  x-appengine-estimated-cpm-us-dollars:$0.002267
  x-appengine-resource-usage:ms=7388 cpu_ms=5069
  x-frame-options:DENY
  x-ua-compatible:chrome=1
  </code></pre>
  <p>In contrast the development app server headers are as expected:</p>
  <pre><code>Cache-Control:max-age=31536000, private
  Content-Length:112628
  content-type:text/html; charset=utf-8
  Date:Wed, 22 Jan 2014 19:57:05 GMT
  Expires:Wed, 22 Jan 2014 19:57:05 GMT
  Server:Development/2.0
  set-cookie:session=; expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Path=/
  x-frame-options:DENY
  x-ua-compatible:chrome=1
  </code></pre>
  <p>Of course I have checked to make sure that I am not adding the extra headers, and I could find no reference of the cache-related headers (<code>pragma</code>, <code>expires</code> and <code>cache-control</code>) being added outside the given view.</p>
  <p>So it seems App Engine is adding a bunch of headers when deployed, which seems unusual. What might I have overlooked?</p>
  <p>-- EDIT --</p>
  <p>As @dinoboff <a href="https://cloud.google.com/appengine/docs/python/requests#cache-control_expires_and_vary" rel="nofollow noreferrer">noted from the docs in a comment below</a>:</p>
  <blockquote>
  <p>Cache-Control, Expires and Vary</p>
  <p>These headers specify caching policy to intermediate web proxies (such as Internet Service Providers) and browsers. If your script sets these headers, they will usually be unmodified, <strong>unless the response has a Set-Cookie header, or is generated for a user who is signed in using an administrator account</strong>.</p>
  </blockquote>