It seems that any parameter of HttpResponseMessage.Headers.CacheControl causes the Expires header to be emitted as set, but without it Expires expires with a value of -1. Try setting response.Headers.CacheControl = new CacheControlHeaderValue() , but without setting the maximum age. You should be able to do this anywhere that the HttpResponseMessage provides; e.g. in ApiController or DelegatingHandler .
According to RFC2616 , if the maximum age of CacheControl is present, it overrides Expires, but if you just set it as above, it should work.
Whether this is a good idea is controversial since Expires is HTTP 1.0 and CacheControl is HTTP 1.1.
source share