Cache-Control header / past Expires in inner exchange's response.

[nyaxt]

I've seen SXG inner exchange's response headers containing:

Cache-Control: no-cache, no-store
Expires: <past date>

How should we handle these cases?

• Option 1) Add them to the banned headers list
• Option 2) As proposed by @mnot in Reject uncachable status code #326, enforce the response cacheability algorithm in verification steps.

My preference is Option 2.

[twifkak]

Why should these apply to verification? If a non-signed response comes with these response headers, the browser will display it, but not cache it. I would assume the same behavior would apply here.