| Q | A | ---------------- | ----- | Bug report? | yes | Feature request? | no | BC Break report? | no | RFC? | no | Symfony version | 4.0.0-BETA4 This is since this commit: https://github.com/symfony/symfony/commit/cf4eb4602ace6c32523133b09feab79a53f8fa2d Because of this change the `Cache-Control` header is sent always. As far as I know the `session.cache_limiter` off state is `''` and not `'0'`. http://php.net/manual/en/function.session-cache-limiter.php