Cache-control: no-store, must-revalidate not sent to client browser in IIS7 + ASP.NET MVC
I am trying to make sure that a certain page is never cached, and never shown when the user clicks the back button. This very highly rated answer (currently 1068 upvotes) says to use : Response.AppendHeader("Cache-Control", "no-cache, no-store, must-revalidate"); Response.AppendHeader("Pragma", "no-cache"); Response.AppendHeader("Expires", "0"); However in IIS7 / ASP.NET MVC, when I send those headers then the client sees these response headers instead: Cache-control: private, s-maxage=0 // that's not what I set them to Pragma: no-cache Expires: 0 What happened to the cache-control header?