The problem was, we were using the acs-commons environment indicator. Disabling this, resolved the issue. Because the saml authentication handler does this in PostBinding: httpResponse.addHeader("cache-control", "private, max-age=0, no-cache, no-store"); httpResponse.getOutputStream().pr...