ESI not working in AEM as a Cloud Service

The AEM CDN documentation explicitly states that only responses containing private, no-cache, or no-store in Cache-Control are guaranteed not to be cached. However, there is a key nuance: AEM as a Cloud Service may silently strip cache headers if it detects the content as "uncacheable by Dispatcher," unless you use the always keyword paired with private.

Change your <LocationMatch> for nocache paths to use private explicitly:

<LocationMatch "\.nocache\.html$">
  SetEnv no-gzip 1
  Header unset Cache-Control
  Header unset Surrogate-Control
  Header unset Expires
  Header always set Cache-Control "private, no-store, no-cache, max-age=0"
  Header always set Surrogate-Control "no-store, max-age=0"
</LocationMatch>

The private directive is the most reliable signal for the Adobe CDN to skip caching entirely.

The cdn.yaml (deployed via Config Pipeline) allows you to enforce response header rules directly at the CDN edge, independent of what comes from origin. This acts as a safety net if Dispatcher headers are being altered or ignored.

kind: "CDN"
version: "1"
metadata:
  envTypes: ["dev", "stage", "prod"]
data:
  responseTransformations:
    rules:
      - name: nocache-sdi-fragments
        when:
          reqProperty: path
          matches: ".*\\.nocache\\.html$"
        actions:
          - type: unset
            respHeader: Cache-Control
          - type: unset
            respHeader: Surrogate-Control
          - type: set
            respHeader: Cache-Control
            value: "private, no-store, no-cache, max-age=0"
          - type: set
            respHeader: Surrogate-Control
            value: "no-store, max-age=0"

The Apache Sling SDI documentation also recommends explicitly disabling caching at the Dispatcher level for .nocache.html files:

/rules {
  /0001 { /glob "*.nocache.html" /type "deny" }
}

If you are on a BYOCDN setup, you need to ensure your proprietary CDN is also configured to honor the headers so that pages are not cached by your primary CDN. If not, the configuration provided by Giuseppe should work just fine.

Hope this helps