How can I set response headers in JSF?

To set it on the HTML/JSF responses you can configure it in your layouts directly with the expression language:

Directly in the layout:

<f:event type="preRenderView" listener="#{facesContext.externalContext.response.setHeader('Cache-Control', 'no-cache, no-store')}" />

In a Managed Bean, called in the layout:

<f:event type="preRenderView" listener="#{responseHeader.setNoCache}" />

@javax.faces.bean.ManagedBean
@ApplicationScoped
public class ResponseHeader {
    public void setNoCache() {
        HttpServletResponse response = (HttpServletResponse) FacesContext
                .getCurrentInstance().getExternalContext().getResponse();
        response.setHeader("Cache-Control", "no-cache, no-store");
    }
}

Response Header Filter

To generally manage response headers also for other resources than the HTML/JSF responses (e.g. images etc.) the best way is to create a own servlet filter or use the exisitng one like ResponseHeaderFilter.

Onyl expires header for all resources

If you only want to control the expires header, there is already a nice built in servlet filter for that. See tomcat documentation for more info

With Apache

If you use the Apache Integration you can use the Module mod headers or the Module mod expires.