Mvc: cache-control: no-store header being overwritten by .net core CSRF token generator

Created on 22 Jun 2017 · 5Comments · Source: aspnet/Mvc

In order to solve a caching issue in IE I decorated my controllers with
[ResponseCache(Location = ResponseCacheLocation.None, NoStore = true)]

When looking at the response headers in the browser developer tools I noticed that some of my controller action responses had the expected Cache-Control:no-store,no-cache

But others didn't. This was driving me nuts and after doing some digging I found the explanation in the msdn documentation

https://docs.microsoft.com/en-us/aspnet/core/performance/caching/middleware

So I tried disabling CSRF protection in my form by using the asp-antiforgery="false" attribute and sure enough the no-store directive was added to my response header.

So my question is: Is there any way to achieve this without having to sacrifice security by disabling CSRF protection in my forms? It definitely doesn't feel right to have to disable that just to prevent IE from caching my pages.

Thanks in advance for any help/advice that you can give me!

Source

univhack

Most helpful comment

FYI here's a workaround that someone else found for this in 1.X.Y. We already addressed this issue in 2.0.0 https://github.com/aspnet/Antiforgery/blob/f258be61fd05ff23d286661c58409b1eba004440/src/Microsoft.AspNetCore.Antiforgery/Internal/DefaultAntiforgery.cs#L372

rynowak on 22 Jun 2017

👍2

All 5 comments

What's the exact issue here with the cache headers? Is the problem that you need Cache-Control: no-cache, no-store and you are getting Cache-Control: no-cache?

rynowak on 22 Jun 2017

@rynowak the issue is that I need the headers to be Cache-Control: no-cache, no-store and adding the controller attributes allow me to achieve this everywhere but in pages where there is a form (unless I disable CSRF protection in which case it does work but I am left without protection against that type of attack)

Also, it looks like you closed the issue in both the home and the MVC repos!

univhack on 22 Jun 2017

No, this is issue is open.

rynowak on 22 Jun 2017