Our investigations have shown us that not all browsers respect the http cache directives in a uniform manner.
For security reasons we do not want certain pages in our application to be.
I don't find get the practical difference between cache-control:no-store and cache-control:no-cache.
As far as i know, no-store means that no cache device is allowed to cache that.
The list is just examples of different techniques, it's not for direct insertion.
If copied, the second would overwrite the first and the fourth would overwrite the third because of the http-equiv.
Beware of etag even if you are using nocache, the etag header isn't removed, because it works in a different way.
It's generated at the end of the request and could be another source of.
Ok, even if you aren't using express, what essentially needed is to set the nocache headers.
I'm adding the headers in a reusable middleware, otherwise you can set those headers in any way.