Disabling Spring Security headers does not work
<p>I need to disable the cache control headers in my Spring Security conf.</p>

<p>According to the documentation a simple <code>http.headers.disable()</code> should do it, but I still see the</p>

<pre><code>Cache-Control:no-cache, no-store, max-age=0, must-revalidate
Expires:0
Pragma:no-cache
</code></pre>

<p>headers in responses.</p>

<p>My current security config is:</p>

<pre><code>http.antMatcher("/myPath/**") // "myPath" is of course not the real path
    .headers().disable()
    .authorizeRequests()
     // ... abbreviated
    .anyRequest().authenticated();
</code></pre>

<p><strong>Things I've tried so far:</strong></p>

<p><strong>application.properties</strong></p>

<p>I added the <code>security.headers.cache=false</code> line, but that made no difference.</p>

<p><strong>Using a filter</strong></p>

<p>I tried the following filter:</p>

<pre><code>@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
  chain.doFilter(request, new HttpServletResponseWrapper((HttpServletResponse) response) {
      @Override
      public void setHeader(String name, String value) {
        if (name.equalsIgnoreCase("Cache-Control")) {
          value = "";
        } else if (name.equalsIgnoreCase("Expires")) {
          value = "";
        } else if (name.equalsIgnoreCase("Pragma")) {
          value = "";
        }
        super.setHeader(name, value);
      }
  });
}
</code></pre>

<p>After adding logging I saw that this filter only writes the <code>X-XSS-Protection</code> header, all the cache headers are written somewhere later and this filter doesn't have access to "override" them. This happens even if I add this filter at the last position of the security filter chain.</p>

<p><strong>Using an interceptor</strong></p>

<p>I tried the following interceptor:</p>

<pre><code>@Override
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
    String requestUri = request.getRequestURI();
    response.setHeader("Cache-Control", "max-age=3600");
    response.setHeader("Expires", "3600");
    response.setHeader("Pragma", "");
}
</code></pre>

<p>This (quite predictably) just added the headers, meaning that the original <code>no-cache</code> headers still appear in addition to the ones added by the interceptor.</p>

<p>I'm at my wits end here. How do I get rid of the cache control header set by Spring security?</p>