This related to bug #8073

You are right when you said it is necessary to send a header with no-cache when php send a cookie.
But I think it is not normal to change the header when php sends no cookie.

So I changed the code:
before
...
 if (send_cookie)
  php_session_send_cookie(PSLS_C);
 
 if (define_sid) {
  char *buf;

  buf = emalloc(strlen(PS(session_name)) + strlen(PS(id)) + 5);
  sprintf(buf, "%s=%s", PS(session_name), PS(id));
  REGISTER_STRING_CONSTANT("SID", buf, 0);
 } else
  REGISTER_STRING_CONSTANT("SID", empty_string, 0);
 PS(define_sid) = define_sid;

 PS(nr_open_sessions)++;

 php_session_cache_limiter(PSLS_C);
 php_session_initialize(PSLS_C);
...

after the change
...
 if (send_cookie) {
  php_session_send_cookie(PSLS_C);
  php_session_cache_limiter(PSLS_C);
 }
 
 if (define_sid) {
  char *buf;

  buf = emalloc(strlen(PS(session_name)) + strlen(PS(id)) + 5);
  sprintf(buf, "%s=%s", PS(session_name), PS(id));
  REGISTER_STRING_CONSTANT("SID", buf, 0);
 } else
  REGISTER_STRING_CONSTANT("SID", empty_string, 0);
 PS(define_sid) = define_sid;

 PS(nr_open_sessions)++;

 php_session_initialize(PSLS_C);
...

With this modification the no-cache header is send only once. Maybe the modification is made a wrong way!?

Georges Dagousset
France
:-)