It appears that Symfony always starts a session for anonymous users, even though it may not be required.

The offending line appears to be

This makes caching responses on Vary: Cookie pretty badly performing, as every new anonymous visitor is getting a new and unique php session id cookie and will result in a cache miss.

Obviously the preference would be that a session is not started for anonymous users unless absolutely necessary, thus triggering far more cache hits for Vary: Cookie response caching.

Apologies if my diagnoses or logic is completely wrong.

/ping @Drak @schmittjoh @lsmith77