Make request cacheable when it has "no-cache" header

[beltoev]

Why do we trust the client?

For example, "no-cache" header can be used for the ddos attacks. Besides OutputCacheAttribute (ASP.NET MVC 5) doesn't pay attention to this header.

Can we change the behavior of the attribute or add it to the settings?

[Tratcher]

Yes, this is a basic design question we haven't reconciled yet. The cache was built as a real HTTP cache (that honors client headers), not an output cache (that is only beholden to the server). The only additional feature it has is VaryByQueryKeys.

We either need to pivot the whole component to become a true output cache, or to provide a separate middleware that fulfills that role.

@glennc

[GokGokalp]

Any news?

[JunTaoLuo]

We have not prioritized this work item for the next release. I'm putting this in backlog for now but @muratg may decide to move it out if he disagrees.

[aspnet-hello]

This issue was moved to dotnet/aspnetcore#2607