MediaWiki controllers which do not use the normal header handling of OutputPage (call `OutputPage::disable()`, or do not use OutputPage at all) do their own implementation of "don't cache if the user is authenticated". There are many ways to get that wrong, and several controllers do. This task is about cleaning them up.
[] provide a helper method (along the lines of `OutputPage::sendCacheControl()`, presumably) that any controller can call instead of trying to come up with their own logic
[] #mediawiki-extensions-centralnotice `Special:BannerLoader` [[https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/CentralNotice/+/114220fed67de8669210e4780b117475ca1637e1/includes/specials/SpecialBannerLoader.php#164|should not set]] `Cache-Control: public` when there's a session
[] #mediawiki-extensions-centralnotice `Special:HideBanners` [[https://gerrit.wikimedia.org/g/mediawiki/extensions/CentralNotice/+/114220fed67de8669210e4780b117475ca1637e1/includes/specials/SpecialHideBanners.php#56|should not set]] `Cache-Control: public` for anonymous sessions
[] #mediawiki-extensions-wikibaserepository `Special:EntityData` [[https://gerrit.wikimedia.org/g/mediawiki/extensions/Wikibase/+/ba6bf49e98ea981f852aa0528a556d66717a08ee/repo/includes/LinkedData/EntityDataRequestHandler.php#573|should not set]] `Cache-Control: public` when there's a session
[] `action=raw` [[https://gerrit.wikimedia.org/g/mediawiki/core/+/eca155f6c575a6fc69a75d5f372c04a1a4a2dcaf/includes/actions/RawAction.php#100|should not set]] `Cache-Control: public` for anonymous sessions
[] `PageHistoryCountHandler` [[https://gerrit.wikimedia.org/g/mediawiki/core/+/eca155f6c575a6fc69a75d5f372c04a1a4a2dcaf/includes/Rest/Handler/PageHistoryCountHandler.php#166|should not set]] `Cache-Control: public` when there's a session
** `rest.php` should probably have some kind of generic facility for this
AjaxResponse (see {T42787}) also has code for enabling caching, but it does not seem reachable.