Req #66851 [Wfx]: $_SERVER holds unrelated client stuff
Edit report at https://bugs.php.net/bug.php?id=66851&edit=1
ID: 66851
User updated by: eldmannen+php at gmail dot com
Reported by: eldmannen+php at gmail dot com
Summary: $_SERVER holds unrelated client stuff
Status: Wont fix
Type: Feature/Change Request
Package: Variables related
PHP Version: Irrelevant
Block user comment: N
Private report: N
New Comment:
So GATEWAY_INTERFACE, SERVER_ADDR, SERVER_SOFTWARE, and SERVER_ADMIN aren't server-originated
data?
While things like HTTP_USER_AGENT and HTTP_REFERER are from the client.
I see a distinction between these. Server and client.
Some of these can be trusted, others can not.
Previous Comments:
------------------------------------------------------------------------
[2014-03-09 16:48:47] phpmpan at mpan dot pl
$_SERVER doesn't hold server-originated data. It holds served-possesed data about
the execution environment. This is, among other things, information about the request currently
being processed.
------------------------------------------------------------------------
[2014-03-07 23:25:09] eldmannen+php at gmail dot com
Description:
------------
http://websec.io/2012/08/11/Can%27t-Trust-the-$_SERVER.html
The superglobal $_SERVER contains unrelated stuff such as HTTP_USER_AGENT and HTTP_REFERER which are
from the client and set by the client, not the server.
These ought to be stripped out and moved into a new superglobal called $_CLIENT.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=66851&edit=1
Thread (5 messages)