Cache-Control header always prepend "no-store, no-cache, must-revalidate"

I'm using PHP 8.1 and CI 4.3.7
I've built a filter to change HTTP caching (Cache-Control header) for some pages of my website.

PHP Code:

class CacheFilter implements FilterInterface
{
    public function before(RequestInterface $request, $arguments = null)
    {
        // Get the response instance
        $response = service('response');
        // $response = \Config\Services::response();

        // Define caching options
        $options = [
            'public',
            'max-age'  => HOUR,
            's-maxage' => DAY,
        ];

        $response->setCache($options);
    }
... 


I apply the filter (alias is 'cache') to the routes :

PHP Code:

$routes->get('page', 'PageController::view', ['filter' => 'cache']); 


I always end up with this values for Cache-Control in the response header:

Code:

Cache-Control: no-store, no-cache, must-revalidate, public, max-age=3600, s-maxage=86400
# OR:
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: public, max-age=3600, s-maxage=86400

The expected response is:

Code:

Cache-Control: public, max-age=3600, s-maxage=86400

because `setCache()` deletes existing values for Cache-Control before applying new ones.

I tried several browsers with the same result. I tried to follow CI code up to codeigniter.php and everything seems right.

So what's the problem ?
Anyone has ever seen this ?

Please create an issue: https://github.com/codeigniter4/CodeIgniter4/issues

Session init in files? See session_cache_limiter() Turn off

Simple CI 4 project for beginners codeigniter-expenses ( topic )

It is already reported:
https://github.com/codeigniter4/CodeIgni...ssues/7266

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper

Session init in files? See session_cache_limiter() Turn off

Yes you're totally right !
Thank you very much for your hint
It led me to the solution I found.
I'll develop it in my answer to Kenjis

---

It is already reported:
https://github.com/codeigniter4/CodeIgni...ssues/7266

Sorry, I didn't check for the issues before posting my message.
I think I found the origin of the problem thanks to ozornick and a solution (that I implemented already, it works).

When using sessions (when the session starts), PHP automatically sends Cache-Control instruction to the header (see my initial post). It implicitely execute this instruction:

PHP Code:

session_cache_limiter('nocache'); 


See: https://www.php.net/manual/en/function.s...he-limiter

The problem is that the headers sent by session_cache_limiter() cannot be replaced or removed by CodeIgniter methods and functions such as:

PHP Code:

// removeHeader() does NOT remove the headers sent by session_cache_limiter()
$response->removeHeader('Cache-Control'); 


The solution is to stop theses headers from being issued BEFORE the session starts by using `session_cache_limiter('');`:

PHP Code:

// We prevent PHP from sending the cache related headers
session_cache_limiter('');
// Start the session
Services::session(); 


That's it. It's not really a bug of CodeIgniter, simply (for my part) the ignorance that when starting a session, PHP would send Cache related headers.

Thanks for your help.

The solution is to stop theses headers from being issued BEFORE the session starts by using `session_cache_limiter('');`:

PHP Code:

// We prevent PHP from sending the cache related headers
session_cache_limiter('');
// Start the session
Services::session(); 


Ok, and where in your code do you put the `session_cache_limiter('')` in order to avoid the error below?

Code:

session_cache_limiter(): Session cache limiter cannot be changed when a session is active

I've tried in the initController method of my BaseController class without success.
What is the official CI4 solution for this header duplication issue?
Is there any way to take control of the Cache-Control header while using sessions in CI4?
TIA.

I've tried in the initController method of my BaseController class without success.
What is the official CI4 solution for this header duplication issue?
Is there any way to take control of the Cache-Control header while using sessions in CI4?
TIA.

I do it in the `app\Config\Events.php` file:

PHP Code:

Events::on('pre_system', static function () {

    /*
    * --------------------------------------------------------------------
    * Session start
    * --------------------------------------------------------------------
    * We start the session here and not in the controller, so it is also available in the models/libraries...
    * which may be executed before the controller is initiated.
    * Under CLI, session halts itself so no need to have it.
    * See: https://codeigniter.com/user_guide/libraries/sessions.html
    */
    if (! is_cli()) {
        // When the session starts, PHP executes implicitely `session_cache_limiter('nocache')`
        // See: https://www.php.net/manual/en/function.session-cache-limiter
        // We prevent PHP from sending headers by using `session_cache_limiter('')`
        session_cache_limiter('');
        // Start the session (no need for `Services::session()->start()`)
        Services::session(); // or: service('session')
    }
} 


I write code in app/Common.php Before init CI

Simple CI 4 project for beginners codeigniter-expenses ( topic )

The bug will be fixed in v4.4.7.
https://github.com/codeigniter4/CodeIgniter4/pull/8601

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper