Merge pull request #8601 from kenjis/fix-duplicate-cache-control-header

fix: duplicate Cache-Control header with Session

Author: kenjis

system/Config/Services.php

@@ -690,6 +690,12 @@ public static function session(?SessionConfig $config = null, bool $getShared =
         $session->setLogger($logger);
 
         if (session_status() === PHP_SESSION_NONE) {
+            // PHP Session emits the headers according to `session.cache_limiter`.
+            // See https://www.php.net/manual/en/function.session-cache-limiter.php.
+            // The headers are not managed by CI's Response class.
+            // So, we remove CI's default Cache-Control header.
+            AppServices::response()->removeHeader('Cache-Control');
+
             $session->start();
         }