From 544a01ae0a2917a382e1c64218f0609784737615 Mon Sep 17 00:00:00 2001 From: Jeow Li Huan Date: Tue, 4 Jun 2019 22:52:16 +0800 Subject: [PATCH] Add no-store to OpenIdConnectHandler cache-control response headers (#10318). (#10741) --- .../Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs b/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs index ad6a298090..b874f96652 100644 --- a/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs +++ b/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs @@ -256,7 +256,7 @@ namespace Microsoft.AspNetCore.Authentication.OpenIdConnect Response.ContentType = "text/html;charset=UTF-8"; // Emit Cache-Control=no-cache to prevent client caching. - Response.Headers[HeaderNames.CacheControl] = "no-cache"; + Response.Headers[HeaderNames.CacheControl] = "no-cache, no-store"; Response.Headers[HeaderNames.Pragma] = "no-cache"; Response.Headers[HeaderNames.Expires] = HeaderValueEpocDate; @@ -442,7 +442,7 @@ namespace Microsoft.AspNetCore.Authentication.OpenIdConnect Response.ContentType = "text/html;charset=UTF-8"; // Emit Cache-Control=no-cache to prevent client caching. - Response.Headers[HeaderNames.CacheControl] = "no-cache"; + Response.Headers[HeaderNames.CacheControl] = "no-cache, no-store"; Response.Headers[HeaderNames.Pragma] = "no-cache"; Response.Headers[HeaderNames.Expires] = HeaderValueEpocDate;