title: Strip off Cache-control and Pragma: no-cache http headers without using an Http Module
body: <p><strong>The Issue</strong>:
  We have a .aspx aka WebForms page that enables users to download the displayed report as an MS-Excel download. This page is served as part of a web-application as well as inside a browser frame (ieframe) in a Desktop app.</p>
  
  <ol>
  <li>The download works fine over HTTP on all browsers as well as inside the browser frame</li>
  <li>When we switch to HTTPS (in the production environment) the download refuses to work </li>
  </ol>
  
  <p>This <a href="https://stackoverflow.com/questions/12300154/unable-to-render-excel-download-from-aspx-page">SO Question</a> details the problem and the cause in detail.</p>
  
  <p>As the solution involved stripping off Cache-control: no-cache and Pragma: no-cache, I wrote an Http module to achieve this.</p>
  
  <p><strong>The Proposed Solution</strong>:</p>
  
  <p>The HttpModule is basically doing this using the PreSendRequestHeaders event:</p>
  
  <pre><code>private void OnPreSendRequestHeaders(object sender, EventArgs e)
          {
              if (null == _httpApplication)
              {
                  return;
              }
  
              if (_httpApplication.Context != null)
              {
                  var response = _httpApplication.Response;
                  if (_httpApplication.Request.Url.AbsoluteUri.ToLowerInvariant().Contains("mypage.aspx"))
                  {
                      HeadersToCloak.ForEach(header =&gt; response.Headers.Remove(header));
                      response.Headers.Add("Cache-Control", "private, max-age=15");
                  }
              }
          }
  </code></pre>
  
  <p><strong>The bone-of-contention</strong>:
  During code-review, I've been told that this would not be a good solution as my custom module would run for all requests and would thus have performance implications.
  The web.config for the application has runAllManagedModulesForAllRequests="true" under system.webServer node and this is required for other functionality required by the application.</p>
  
  <p><strong>What I have tried</strong>:</p>
  
  <ol>
  <li>Tried placing the code to remove and add header on the ASPX page itself inside several events (one-by-one) including RenderComplete but when I examine the response in Fiddler, the troublesome headers are still there (not replaced with intended headers)</li>
  <li>I've looked up the preCondition tag as explained <a href="http://www.iis.net/learn/get-started/introduction-to-iis/iis-modules-overview#Precondition" rel="nofollow noreferrer">HERE</a> but since we run under integrated pipeline mode and have runAllManagedModulesForAllRequests="true", the preCondition would be meaningless</li>
  </ol>
  
  <p><strong>Questions requiring help:</strong></p>
  
  <p>Q1) Given that the module will run for all requests including static files and that I'm doing actual work only if the requested URI is for the page in question, how much of a performance impact does running this module have? </p>
  
  <p>Q2) How can I otherwise remove and set headers only for one page?</p>
  
  <p>Q3) Given the constraints, is it possible to only run this module for managed requests only or for my page only (don't think the latter is possible)?</p>