How to override Cache-Control header?

[siarheipashkevich]

Hi all,

Laravel application returns Cache-Control: no-cache, private; header by default.

How I can override this and return just no-store ?

Best regards,
Sergey

[wizzymore]

You can create a new middleware and then apply it inside app/http/Kernel.php

<?php
// app/Http/Middleware/CacheControlMiddleware.php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class CacheControlMiddleware
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure(\Illuminate\Http\Request): (\Illuminate\Http\Response|\Illuminate\Http\RedirectResponse)  $next
     * @return \Illuminate\Http\Response|\Illuminate\Http\RedirectResponse
     */
    public function handle(Request $request, Closure $next)
    {
        $response = $next($request);
        $response->headers->set('Cache-Control', 'no-store');
        return $response;
    }
}

[siarheipashkevich]

@wizzymore it's add private also.

[wizzymore]

Please refer to the MDN documentation here:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control

[VladyslavSikailo]

I think the right way here is to use built-in middleware - Route::middleware('cache.headers:no_store')
See https://laravel.com/docs/10.x/responses#cache-control-middleware.

[toby5box]

I found in v8 at least that this was unable to add nonstandard pragmas such as stale-while-revalidate, which meant we had to write new middleware, and after that, Laravel still added an unwanted private automatically.

[OzanKurt]

Any solution to this unwanted private token?

[yabdouniWork]

Hi everyone, any solution to this?

We're encountering an issue where Laravel (via Symfony HTTP Foundation) appends private or public to the Cache-Control headers, even when we explicitly set them. While we are able to override the default Cache-Control values, the appended directive (private or public) remains and cannot be removed.

Here’s what we’ve tried so far:

1. Middleware Approach: Explicitly removed and set the Cache-Control headers, but the issue persists.
2. Response Macro in AppServiceProvider: Added a macro to globally modify headers, but Laravel/Symfony still appends the directive.
3. Server-Side Rewrite: Used .htaccess to rewrite headers, but the application overrides them.
4. We also used the mentioned built in middleware Route::middleware('cache.headers:no_store')

Any guidance or solutions to prevent Symfony from appending private or public would be greatly appreciated!