Add no-store as part of the CacheControl headers to totally prevent response being saved

[aiampogi]

Add no-store as part of the CacheControl headers to totally prevent response being saved

[kevinchalet]

Great, thanks for the details, @Tratcher.

FWIW, I just took a look at the OAuth 2.0/OIDC spec, and both actually "require" returning a Cache-Control: no-store header:

• https://tools.ietf.org/html/rfc6749#section-5.1
• https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse

I guess we'll probably want to comply with the specs at some point 🤣

[kevinchalet]

I'm not opposed to changing that, but it's worth noting that we use the same header value as ASP.NET Core's OIDC/cookies handlers.

@Tratcher is there any particular guideline regarding caching headers in ASP.NET Core? I have the feeling things are a bit inconsistent out there.

[Tratcher]

Yes it's inconsistent. I have one scenario on my backlog where no-store looks like an improvement, but otherwise it's not clear that it will make a difference to most responses & clients.