Bug #70279 [NEW]: HTTP Authorization Header is sometimes passed to newer reqeusts

From: Date: Sun, 16 Aug 2015 00:59:35 +0000
Subject: Bug #70279 [NEW]: HTTP Authorization Header is sometimes passed to newer reqeusts
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-195236@lists.php.net to get a copy of this message 
From:             steffenbrem at gmail dot com
Operating system: Ubuntu Trusty
PHP version:      7.0Git-2015-08-16 (snap)
Package:          *Web Server problem
Bug Type:         Bug
Bug description:HTTP Authorization Header is sometimes passed to newer reqeusts

Description:
------------
I have noticed a strange bug while using NGinx PPA stable and PHP7 FPM
nightly build. When you send a request containing an Authorization
header and after that send a request WITHOUT an Authorization header,
PHP still thinks an Authorization header is present on the request
(while it isn't).

This can cause a lot of trouble, especially since it is the
Authorization header.

Expected result:
----------------
I expect that when you send a request with an authorization header and
then the second time I send a request without an Authorization header,
that for that runtime there is no Authorization header set.

Actual result:
--------------
What is happening now is that the authorization header from the previous
request is also passed to the next requests. Even if you do not provide
an Authorization header for the next requests.

-- 
Edit bug report at https://bugs.php.net/bug.php?id=70279&edit=1
-- 
Try a snapshot (PHP 5.4):   https://bugs.php.net/fix.php?id=70279&r=trysnapshot54
Try a snapshot (PHP 5.5):   https://bugs.php.net/fix.php?id=70279&r=trysnapshot55
Try a snapshot (trunk):     https://bugs.php.net/fix.php?id=70279&r=trysnapshottrunk
Fixed in SVN:               https://bugs.php.net/fix.php?id=70279&r=fixed
Fixed in release:           https://bugs.php.net/fix.php?id=70279&r=alreadyfixed
Need backtrace:             https://bugs.php.net/fix.php?id=70279&r=needtrace
Need Reproduce Script:      https://bugs.php.net/fix.php?id=70279&r=needscript
Try newer version:          https://bugs.php.net/fix.php?id=70279&r=oldversion
Not developer issue:        https://bugs.php.net/fix.php?id=70279&r=support
Expected behavior:          https://bugs.php.net/fix.php?id=70279&r=notwrong
Not enough info:            https://bugs.php.net/fix.php?id=70279&r=notenoughinfo
Submitted twice:            https://bugs.php.net/fix.php?id=70279&r=submittedtwice
register_globals:           https://bugs.php.net/fix.php?id=70279&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70279&r=php4
Daylight Savings:           https://bugs.php.net/fix.php?id=70279&r=dst
IIS Stability:              https://bugs.php.net/fix.php?id=70279&r=isapi
Install GNU Sed:            https://bugs.php.net/fix.php?id=70279&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=70279&r=float
No Zend Extensions:         https://bugs.php.net/fix.php?id=70279&r=nozend
MySQL Configuration Error:  https://bugs.php.net/fix.php?id=70279&r=mysqlcfg

Thread (11 messages)

« previous php.bugs (#195236) next »