From: spam02 at pornel dot net
Operating system: *
PHP version: 4CVS-2007-03-01 (snap)
PHP Bug Type: Session related
Bug description: Overly restrictive/invalid headers sent as session cache limiters

Description:
------------
Currently, *by default*, PHP sends *the most restrictive* anti-caching
directives possible.

* no-store is intended as a security measure, not regular cache-control
* must-revalidate alone doesn't prevent caching, just requires browser to
revalidate it after it expires. This however, with no-cache prevents use
of "offline browsing" feature.
* pre-check and post-check are non-standard directives that let Internet
Explorer revalidate cached objects less frequently and/or asynchronously.

Please don't use these directives in the default configuration (called
"nocache" cache_limiter), as their use in majority of cases is either
unjustified or invalid and causes performance and usability problems (for
example: [url]https://bugzilla.mozilla.org/show_bug.cgi?id=261312[/url]).

BTW: it turns out that Opera (and most likely other browser vendors) do
not fully support these directives *because* PHP abuses them
([url]http://my.opera.com/yngve/blog/2007/02/27/introducing-cache-contexts-or-why-the[/url]
"This abuse is the reason why must-revalidate is only obeyed for secure
sites.")

Reproduce code:
---------------
<?php session_start();


Expected result:
----------------
Cache-control: no-cache


Actual result:
--------------
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,
pre-check=0


--
Edit bug report at [url]http://bugs.php.net/?id=40686&edit=1[/url]
--
Try a CVS snapshot (PHP 4.4): [url]http://bugs.php.net/fix.php?id=40686&r=trysnapshot44[/url]
Try a CVS snapshot (PHP 5.2): [url]http://bugs.php.net/fix.php?id=40686&r=trysnapshot52[/url]
Try a CVS snapshot (PHP 6.0): [url]http://bugs.php.net/fix.php?id=40686&r=trysnapshot60[/url]
Fixed in CVS: [url]http://bugs.php.net/fix.php?id=40686&r=fixedcvs[/url]
Fixed in release: [url]http://bugs.php.net/fix.php?id=40686&r=alreadyfixed[/url]
Need backtrace: [url]http://bugs.php.net/fix.php?id=40686&r=needtrace[/url]
Need Reproduce Script: [url]http://bugs.php.net/fix.php?id=40686&r=needscript[/url]
Try newer version: [url]http://bugs.php.net/fix.php?id=40686&r=oldversion[/url]
Not developer issue: [url]http://bugs.php.net/fix.php?id=40686&r=support[/url]
Expected behavior: [url]http://bugs.php.net/fix.php?id=40686&r=notwrong[/url]
Not enough info: [url]http://bugs.php.net/fix.php?id=40686&r=notenoughinfo[/url]
Submitted twice: [url]http://bugs.php.net/fix.php?id=40686&r=submittedtwice[/url]
register_globals: [url]http://bugs.php.net/fix.php?id=40686&r=globals[/url]
PHP 3 support discontinued: [url]http://bugs.php.net/fix.php?id=40686&r=php3[/url]
Daylight Savings: [url]http://bugs.php.net/fix.php?id=40686&r=dst[/url]
IIS Stability: [url]http://bugs.php.net/fix.php?id=40686&r=isapi[/url]
Install GNU Sed: [url]http://bugs.php.net/fix.php?id=40686&r=gnused[/url]
Floating point limitations: [url]http://bugs.php.net/fix.php?id=40686&r=float[/url]
No Zend Extensions: [url]http://bugs.php.net/fix.php?id=40686&r=nozend[/url]
MySQL Configuration Error: [url]http://bugs.php.net/fix.php?id=40686&r=mysqlcfg[/url]