title: Antiforgery and cache-control header ASP.NET core
body: <p>I am trying to override <code>cache-control</code> header set by default antiforgery of asp.net core 2.0</p>
  
  <p>.net core always sets it to <code>no-cache, no-store</code>. I am trying to use <code>private</code> which actually works as I wanted. <code>no-cache, no-store</code> doesn't seem to always work giving me some kind of <code>antiforgery token was meant for ... user..</code> kind of error occasionally. Which setting <code>cache-control</code> to <code>private</code> seems to solve.</p>
  
  <p>But .net core doesn't let me override the default <code>cache-control</code> set by antiforgery.</p>
  
  <p>I have tried following:</p>
  
  <pre><code>  public async Task&lt;IActionResult&gt; Login(string returnUrl)
    {
            HttpContext.Response.Headers.Append(Microsoft.Net.Http.Headers.HeaderNames.CacheControl, "private");
         ....
    }
  </code></pre>
  
  <p>Also</p>
  
  <pre><code> public class NoCacheAttribute : ActionFilterAttribute
   {
         public override void OnResultExecuting(ResultExecutingContext context)
         {
          // tried both
          //context.HttpContext.Response.Headers.Add(HeaderNames.CacheControl, "private");
          //context.HttpContext.Response.Headers[HeaderNames.CacheControl] = "private";
         }
   }
  </code></pre>
  
  <p>Note: using for http only right now</p>