v2.5.3

Cache-Control of the pages with a session (PR #39)

• config/core.php sets Session.cacheLimiter to nocache. CakePHP 2 gives PHP the cache limiter
  must-revalidate when the setting is missing, for Internet Explorer 8 and before; PHP does not know this value and
  sent no cache header, so the pages that start a session had no Cache-Control. PHP now sends
  Cache-Control: no-store, no-cache, must-revalidate with them, as with CakePHP 5.

Updating an Application

Add 'cacheLimiter' => 'nocache' to the Session settings of config/core.php:

Configure::write('Session', [
    'defaults' => 'php',
    'cacheLimiter' => 'nocache',
]);

An action that must be cached, e.g. a download, sets its own headers with $this->response->cache(). The rule
cakephp2-config-session-cache-limiter of pieceofcake2/security-sast reports the missing setting.

Full Changelog: v2.5.2...v2.5.3