title: IIS 7.0 - IIS adding "private" to cache-control, where is that coming from
body: <p>Because we protect .PDF files from anonymous users, we have a custom handler so we have an entry
      </p>
  
  <p>We also made a change to the http headers to add "cache-control: no-cache,no-store" via IIS 7 management which creates web.config entries under system.webserver element as follows:</p>
  
  <pre><code>&lt;httpProtocol&gt;
  
    &lt;customHeaders&gt;
      &lt;clear /&gt;
      &lt;add name="cache-control" value="no-cache,no-store" /&gt;
    &lt;/customHeaders&gt;
  
  &lt;/httpProtocol&gt;
  </code></pre>
  
  <p>When I review the Response headers in a burpsuite session, I see for .aspx pages: cache-control: no-store,no-cache,no-store</p>
  
  <p>But for PDF pages: </p>
  
  <p>Cache-Control: <b>private</b>,no-cache,no-store </p>
  
  <p>My goal would be to get everything to just "no-cache, no-store".  I am not sure what I am missing.  There are no other cache settings in the web.config.   Please advise on how to remove "private" from PDF pages and extra no-store from all else.  Other static pages that go through the  System.Web.StaticFileHandler, and they also have the "no-store,no-cache,no-store".</p>