Symfony 3.4 http cache , always Cache-Control: max-age=0, must-revalidate, private

This behaviour is new as of Symfony 3.4 and 4.0. If a user session has been initialized it will always set the headers as described in your question.

Introduced in Symfony 4.1 you can override this behaviour. However as this is a new feature this will not be backported to Symfony 3.4.

$response->headers->set(AbstractSessionListener::NO_AUTO_CACHE_CONTROL_HEADER, 'true');

You can read about this in the Symfony documentation: HTTP Caching and User Sessions

Probably the best way to do this would be to use Service decoration, but i prefered the dirty way for now.

In my case i just needed the shared cached headers for a specific controller.

Workaroung for Symfony 3.4.*:

Create a listener with lower priority than Symfony\Component\HttpKernel\EventListener\SessionListener in services.yml (don't know if this is recommended):

AppBundle\Listener\ResponseListener:    tags:        - { name: kernel.event_listener, event: kernel.response, priority: -1001 }

Then in AppBundle\Listener\ResponseListener:

<?phpnamespace AppBundle\Listener;use Symfony\Component\HttpKernel\Event\FilterResponseEvent;class ResponseListener{    public function onKernelResponse(FilterResponseEvent $event)    {        $response = $event->getResponse();        $controller = $event->getRequest()->attributes->get('_controller');        $requiredAssetAction = "AppBundle\Controller\Website\AssetsController::assetAction";        if ($controller == $requiredAssetAction) {            $response->headers->addCacheControlDirective('max-age', 900);            $response->headers->addCacheControlDirective('s-maxage', 900);            $response->headers->addCacheControlDirective('must-revalidate', true);            $response->headers->addCacheControlDirective('public', true);            $response->headers->removeCacheControlDirective('private');        }        $event->setResponse($response);    }}

Are you using a reverse proxy like the Symfony one?https://symfony.com/doc/3.4/http_cache.html#symfony-reverse-proxy

Also, in your example, the annotation has public=false while the controller will have public true.

Another possible problem would be that your webserver (Apatche etc) is configured to add that header or an option in your .htaccess file specifies this.