The correct minimum set of headers that works across all mentioned clients (and proxies): Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 The Cache-Control is per the HTTP 1.1 spec for clients and proxies (and implicitly required by some clients next to Expires).Read More