#36705 [Opn->Csd]: Location header results in duplicate Status header ([f]cgi only)

ID: 36705 Updated by: bjori@php.net Reported By: alisencer at gmail dot com -Status: Open +Status: Closed -Bug Type: Documentation problem +Bug Type: Unknown/Other Function Operating System: FreeBSD PHP Version: 5.1.2 New Comment: bjori@lindsay:~$ ./php/5.3/sapi/cgi/php-cgi <?php header("Status: 301"); header("Location: http://www.example.org"); ?> X-Powered-By: PHP/5.3.0-dev Status: 301 Location: http://www.example.org Content-type: text/html; charset=utf-8 Works fine now... Previous Comments: ------------------------------------------------------------------------ [2006-12-07 20:21:29] chris at vault5 dot com This bug is filed against FreeBSD but it is certainly not limited to that OS. Using the Microsoft IIS FastCGI ISAPI extension this issue occurs on IIS, too. ------------------------------------------------------------------------ [2006-05-03 18:37:20] phpbugs at thequod dot de As far as I remember from looking around because of the already mentioned "bogus" bug http://bugs.php.net/bug.php?id=33225: The CGI spec says that there should only be one Status header. In my humble opinion, PHP should take care of sending only one status header. In the case of "Location:" any existing one should get overwritten and not added. ------------------------------------------------------------------------ [2006-04-22 07:57:34] bryan at b1t5 dot com The most effective workaround is to just edit mod_fastcgi.c ------------------------------------ if (strcasecmp(name, "Status") == 0) { int statusValue = strtol(value, NULL, 10); if (hasStatus) { /* comment out the braindead line below */ /* goto DuplicateNotAllowed; */ } if (statusValue < 0) { fr->parseHeader = SCAN_CGI_BAD_HEADER; return ap_psprintf(r->pool, "invalid Status '%s'", value); } hasStatus = TRUE; r->status = statusValue; r->status_line = ap_pstrdup(r->pool, value); continue; } ------------------------------------ apache doesn't care how many times you set r->status. Set it once, twice, 500 times even -- it doesn't matter cuz r is just a struct you fill up before calling ap_send_http_header(r) ------------------------------------------------------------------------ [2006-03-13 03:55:42] judas dot iscariote at gmail dot com as an effective workaround to this problem, you can use PEAR HTTP_Header class. hint : method sendStatusCode() ------------------------------------------------------------------------ [2006-03-12 19:39:18] ali dot sencer at gmail dot com > and we can't do anything about Apache changing its behaviour. I hadn't considered that, sorry. And thank you for taking the time. > Why don't you just send the appropriate status header with > the header() call? The issue is, we send a Status: 200 very early to override the 404 (from the error-handler). After that the code branches in many different ways, and plugins and extensions sometimes make changes to (i.e. replace) the Status-code as well. Given that in some situations we need to use a Location-header, we now have to make sure that nobody has ever used "Status: " before. So, yeah we can workaround this, but the situation as it is, is everything but intuitive. I guess we'll have to make do.... ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/36705 -- Edit this bug report at http://bugs.php.net/?id=36705&edit=1