I am also facing a similar kind of issue in case of SAML. When the IdP is redirecting to AEM with SAMLResponse, it is returning 204 No Content. But if I execute the same request through Postman then it is working perfectly fine. I couldn't find the request neither in request and access logs nor on Recent requests console: http://localhost:4502/system/console/requests. I even added a breakpoint on SlingMainServlet and the request is not even coming to that,

@Jörg_HohIn my case it is still not adding Cache-Control for uncacheable (denied in cache.any) request.I have usedExpiresByType application/javascript "access plus 1 month" But as soon as I add the entry to deny caching, the Cache-Control header gets removed from the final response.

@Kautuk_shani and @om_vineet, I am not able to understand that how does this resolve the given use case?? If we keep the XF component locked on the template then the same XF will be used on all the brands and if we keep it unlocked then we have to author the XF path on all the pages. How can we solve this?