Requests that start a session should not be allowed to be cached in page cache

I've been tracking down a bug that happen on a custom page that set some session variables but ended up being cached.

I guess this custom page violates HTTP idempotency. In short, a GET or HEAD request should not modify data on the server.

The page cache module assumes that developers respect this principle. I.e., it assumes that GET and HEAD requests do not modify data and as a consequence do not try to set session values.

In order to modify data (even if its only session data), you need to use POST.

To expand a little bit on the explanation above. Drupal in fact allows you to opt out of caching on specific routes using the no_cache route option. An example of such a route is system.cron in system.routing.yml.

system.cron:
  path: '/cron/{key}'
  defaults:
    _controller: '\Drupal\system\CronController::run'
  options:
    no_cache: TRUE
  requirements:
    _access_system_cron: 'TRUE'

This is also a really good example for a reasonable exception to the HTTP idempotency rule.

I suggest to close this issue (works as designed).

I do not think that there is anything to fix here. Please reopen and provide clear steps for a reproduction or a custom controller / test case if you found a problem with the current page cache implementation.