Best practice of Cache-Control for Bad Request (400)

Question

Currently I have the following action which will tell the client to cache the response for 1200 seconds:

[ResponseCache(Location = ResponseCacheLocation.Client, Duration = 1200)]
[HttpGet("universities")]
public IActionResult GetAllUniversities(string location)
{
    if (/*location not found*/)
      return BadRequest();

    ...
    return Ok(universities);
}

In the response header, when it returns Ok (200), I received the following value:

Cache-Control: private, max-age=1200

Which is perfect as expected.

When I passed the wrong location to the API and the API returns BadRequest (400), it also returns the same Cache-Control value as above.

My question is, is this the best practice? Or should it return no-cache, no-store instead for 400? If it should, how do I return private, max-age=1200 when it's 200 and return no-cache, no-store in .NET Core for this particular action only?

Answer 1

You should use Response Caching Middleware in ASP.NET Core which only caches responses for 200 status code responses and ignores other error responses.

For more information how to implement refer - https://learn.microsoft.com/en-us/aspnet/core/performance/caching/middleware?tabs=aspnetcore2x