Symfony HTTP Cache-Control header overriding

Question

I've answered this question some time ago.

My code at the moment in Symfony 3.4.

 $response->setCache([
     'max_age' => 3600,
     'public' => true,
     's_maxage' => 3600,
 ]);


 // (optional) set a custom Cache-Control directive
 $response->headers->addCacheControlDirective('must-revalidate', true);

 return $response;

In some reason I'm still getting Cache-Control and other headers like this:

Cache-Control: max-age=0, must-revalidate, private, s-maxage=3600
X-Symfony-Cache: GET /: miss

I've noticed that in Symfony 3.2 code works well, but in 3.4 I'm not getting public in Cache-Control (and max-age=0 looks bad too).

Second thing is dumping $response in controller - everything looks fine:

#headers: array:2 [▼
  "cache-control" => array:1 [▼
    0 => "max-age=3600, must-revalidate, public, s-maxage=3600"
  ]
  "date" => array:1 [▼
    0 => "Sat, 12 May 2018 18:42:04 GMT"
  ]
]

Is it somekind of Symfony bug? Should I report it?

Theres a workaround for Symfony 3.4 here: https://stackoverflow.com/a/52846748/597060 — Pedro Casado, Oct 17 '18 at 03:20

adamsafr · Accepted Answer · 2018-08-17T09:42:03.613

7

Same with Symfony 3.4.14. And spent 5 hours to find out that since 3.4 version symfony overrides Cache-Control header if session exists (4.1 documentation).

Symfony 3.4 documentation does not have this info.

edited Aug 17 '18 at 09:42

answered Aug 17 '18 at 09:26

adamsafr

325
3
12

7

In 4.1 you can disable this behaviour with `$response->headers->set(AbstractSessionListener::NO_AUTO_CACHE_CONTROL_HEADER, 'true');` – the_nuts Sep 03 '18 at 13:15
1

Just stumbled upon this answer, thank you for saving me hours of debugging! Do you know of any nice way to disable this behaviour in 3.4? Not found a way to write a custom SessionListener yet. – Nick Jan 16 '19 at 16:54
@Nick unfortunately not:( I had to use redis for sql-results caching and also used decorators for services to cache results – adamsafr Jan 23 '19 at 04:37

score 1 · Answer 2 · answered Jul 11 '19 at 12:41

In my case, I used the symfony/security-bundle which came with a default configuration:

security:
    providers:
     ....
    firewalls:
        main:
          anonymous: true

This code initialise a session. You may want to use :

security:
    providers:
     ....
    firewalls:
        main:
          security: false

Symfony HTTP Cache-Control header overriding

2 Answers2