`Pragma` is a request header, not a response header

[geekysoft]

WordPress incorrectly sends the Pragma request header in return to clients as a responses header. Request headers should never be included in responses to clients and will cause compatibility issues.

The attach patch removes the header.

Multiple HTTP testing and compliance tools report this as an issue. The header is defined in RFC 2616 section 14.32.

[pento]

Thank you for the ticket and patch, @geekysoft!

That's some classic code you've run into there - the earliest instance I could find is [1947], but it might be from earlier. There's no ticket to go with it, but I suspect the original uses were based on ​KB234067, IE 5 and earlier didn't recognise Cache-Control, but they did recognise Pragma as a response header.

Anyway, that was just a fun dive through history. We haven't supported such old browsers in a long time, so I have no problem with this going in.

[SergeyBiryukov]

Replying to pento:

the earliest instance I could find is [1947], but it might be from earlier.

Yup, it was already there as of [8].

[ocean90]

In 37944:

General: Remove the Pragma header from responses.

Pragma is supposed to be a request header, but we've been including it in responses since the beginning of time.

This is a relic dating all the way back to b2, probably originally added because Internet Explorer version 5 and earlier didn't understand the Cache-Control header in responses, but they did (incorrectly) obey the Pragma header.

Internet Explorer 6 and 7 will obey the Pragma response header only if no other cache-related response headers are present (in our case, they are always present), and all other browsers ignore the Pragma response header.

Props geekysoft.
Fixes #37250.