At this point, it may be too late to change the response headers. They will simply be ignored. You can check for response headers in an HTTP debugger tool like Firebug .

In JSP, you need to make sure that they are set before the response is committed (i.e. all headers have already been sent, after which you cannot send other headers). That is, make sure that they are in the very top corner of the JSP file and that the template text is not located before this fragment of the scriptlet. The text of the template may cause the response to be committed. However, it is common practice to use Filter for this.
Deploy javax.servlet.Filter in which the doFilter() method looks like this:
HttpServletResponse httpResponse = (HttpServletResponse) response; httpResponse.setHeader("Cache-Control", "no-cache", "no-store", "must-revalidate"); // HTTP 1.1 httpResponse.setHeader("Pragma", "no-cache"); // HTTP 1.0 httpResponse.setDateHeader("Expires", 0); // Proxies. chain.doFilter(request, response);
Map this in web.xml to url-pattern of *.jsp and it should work.
See also:
source share