Cache Control disabled for 304

Fixes: gh-5534

web/src/test/java/org/springframework/security/web/header/writers/CacheControlHeadersWriterTests.java

@@ -23,6 +23,7 @@ import org.junit.runner.RunWith;
 import org.powermock.core.classloader.annotations.PrepareOnlyThisForTest;
 import org.powermock.modules.junit4.PowerMockRunner;
 
+import org.springframework.http.HttpStatus;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.util.ReflectionUtils;
@@ -124,4 +125,14 @@ public class CacheControlHeadersWriterTests {
 		assertThat(this.response.getHeaderValue("Cache-Control")).isNull();
 		assertThat(this.response.getHeaderValue("Pragma")).isNull();
 	}
+
+	@Test
+	// gh-5534
+	public void writeHeadersDisabledIfNotModified() {
+		this.response.setStatus(HttpStatus.NOT_MODIFIED.value());
+
+		this.writer.writeHeaders(this.request, this.response);
+
+		assertThat(this.response.getHeaderNames()).isEmpty();
+	}
 }

web/src/test/java/org/springframework/security/web/server/header/CacheControlServerHttpHeadersWriterTests.java

@@ -19,6 +19,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 
 import org.junit.Test;
 import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
 import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
 import org.springframework.mock.web.server.MockServerWebExchange;
 import org.springframework.web.server.ServerWebExchange;
@@ -83,4 +84,14 @@ public class CacheControlServerHttpHeadersWriterTests {
 		assertThat(headers.get(HttpHeaders.EXPIRES)).containsOnly(expires);
 	}
 
+	@Test
+	// gh-5534
+	public void writeHeadersWhenNotModifiedThenNoCacheControlHeaders() {
+		exchange.getResponse().setStatusCode(HttpStatus.NOT_MODIFIED);
+
+		writer.writeHttpHeaders(exchange);
+
+		assertThat(headers).isEmpty();
+	}
+
 }