The UserContextListener sets the Symfony-Session-NoAutoCacheControl header. But if a project does not even use sessions and disabled it, then the \Symfony\Component\HttpKernel\EventListener\SessionListener is not active. And thus also does not remove this header again. So FOSHttpCacheBundle should not set this header when sessions are not enabled in

Otherwise it exposes this header to the outside.