HTTP Cache Expiration

Expiration with the Cache-Control Header

Most of the time, you will use the Cache-Control header, which is used to specify many different cache directives:

1
2
3
4
5
6
7
8

use Symfony\Component\HttpKernel\Attribute\Cache;
// ...

#[Cache(public: true, maxage: 600)]
public function index(): Response
{
    // ...
}

1
2
3
4

// sets the number of seconds after which the response
// should no longer be considered fresh by shared caches
$response->setPublic();
$response->setMaxAge(600);

The Cache-Control header would take on the following format (it may have additional directives):

1

Cache-Control: public, max-age=600

Targeting a Specific Cache

The Cache-Control header is read by every cache between your application and the user: the browser, your reverse proxy, a CDN, etc. RFC 9213 allows sending different directives to a single cache using a header named after that cache.

For example, a cache that identifies itself as CDN reads the CDN-Cache-Control header and, when it's present, ignores the Cache-Control and Expires headers entirely. All the other caches keep reading Cache-Control as usual. Cloudflare, Fastly and Akamai support the CDN-Cache-Control header.

This is useful, for example, to keep a response in the CDN for one hour while telling browsers to always revalidate it. Call the cacheControl() method with the name of the target cache:

1
2
3
4
5
6

// for browsers and any other cache
$response->setPrivate();
$response->setMaxAge(0);

// for the CDN only
$response->cacheControl('CDN')->setMaxAge(3600);

The response now contains both headers:

1
2

Cache-Control: max-age=0, private
CDN-Cache-Control: max-age=3600

The object returned by cacheControl() provides the same methods as the response itself: setPublic(), setPrivate(), setMaxAge(), setNoStore(), setImmutable(), setStaleWhileRevalidate() and setStaleIfError(). For any other directive, use the set(), get(), has(), remove() and all() methods. All these methods can be chained:

1
2
3
4

$response->cacheControl('CDN')
    ->setMaxAge(3600)
    ->setStaleWhileRevalidate(60)
    ->set('some-proprietary-directive', 'value');

Expiration with the Expires Header

An alternative to the Cache-Control header is Expires. There's no advantage or disadvantage to either.

According to the HTTP specification, "the Expires header field gives the date/time after which the response is considered stale." The Expires header can be set with the expires option of the #[Cache] attribute or the setExpires() Response method:

1
2
3
4
5
6
7
8

use Symfony\Component\HttpKernel\Attribute\Cache;
// ...

#[Cache(expires: '+600 seconds')]
public function index(): Response
{
    // ...
}

1
2
3
4

$date = new DateTime();
$date->modify('+600 seconds');

$response->setExpires($date);

The resulting HTTP header will look like this:

1

Expires: Thu, 01 Mar 2011 16:00:00 GMT

Note that in HTTP versions before 1.1 the origin server wasn't required to send the Date header. Consequently, the cache (e.g. the browser) might need to rely on the local clock to evaluate the Expires header making the lifetime calculation vulnerable to clock skew. Another limitation of the Expires header is that the specification states that "HTTP/1.1 servers should not send Expires dates more than one year in the future."

Applying Cache Conditionally

Use the if option to apply the #[Cache] attribute only when a given condition is met. This option accepts a closure or an ExpressionLanguage expression that receives the Request object and the controller arguments and must return a boolean value:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpKernel\Attribute\Cache;
// ...

// Using a closure
#[Cache(
    public: true,
    maxage: 3600,
    if: static fn (Request $request): bool => $request->query->has('cache')
)]
public function index(Request $request): Response
{
    // ...
}

// Using an expression
#[Cache(
    public: true,
    maxage: 3600,
    if: "request.query.has('cache')"
)]
public function show(Request $request): Response
{
    // ...
}

When the condition evaluates to true, the cache headers are applied; when it evaluates to false, they are not.

This is useful when you need to enable caching based on runtime conditions such as user authentication state, feature flags, or request parameters. It is also helpful when the controller does not return a Response object directly (e.g. when using FOSRestBundle or other libraries that handle view rendering).