SEC-2331: Cache Control now includes Expires: 0

web/src/main/java/org/springframework/security/web/header/writers/CacheControlHeadersWriter.java

@@ -44,6 +44,7 @@ public final class CacheControlHeadersWriter extends StaticHeadersWriter {
         List<Header> headers = new ArrayList<Header>(2);
         headers.add(new Header("Cache-Control","no-cache, no-store, max-age=0, must-revalidate"));
         headers.add(new Header("Pragma","no-cache"));
+        headers.add(new Header("Expires","0"));
         return headers;
     }
 }

web/src/test/java/org/springframework/security/web/header/writers/CacheControlHeadersWriterTests.java

@@ -47,8 +47,9 @@ public class CacheControlHeadersWriterTests {
     public void writeHeaders() {
         writer.writeHeaders(request, response);
 
-        assertThat(response.getHeaderNames().size()).isEqualTo(2);
+        assertThat(response.getHeaderNames().size()).isEqualTo(3);
         assertThat(response.getHeaderValues("Cache-Control")).isEqualTo(Arrays.asList("no-cache, no-store, max-age=0, must-revalidate"));
         assertThat(response.getHeaderValues("Pragma")).isEqualTo(Arrays.asList("no-cache"));
+        assertThat(response.getHeaderValues("Expires")).isEqualTo(Arrays.asList("0"));
     }
 }