Edit report at https://bugs.php.net/bug.php?id=70279&edit=1
ID: 70279
Comment by: david at nnucomputerwhiz dot com
Reported by: steffenbrem at gmail dot com
Summary: HTTP Authorization Header is sometimes passed to
newer reqeusts
Status: Open
Type: Bug
Package: *Web Server problem
Operating System: Ubuntu Trusty
PHP Version: 7.0Git-2015-08-16 (snap)
Block user comment: N
Private report: N
New Comment:
I can confirm this is happening in 7.0.0RC1 too running php-fpm and nginx 1.2.0. It appears to be
any http header not just the Authorization header. It's causing problems on some sites because
$_SERVER['HTTP_X_REQUESTED_WITH'] sometimes contains 'XMLHttpRequest' even if it
wasn't sent in the current request but it was sent in previous requests. The problem is very
intermittent and trivial scripts don't seem to reproduce it.
Previous Comments:
------------------------------------------------------------------------
[2015-08-16 02:29:11] steffenbrem at gmail dot com
Tested it on Debian Jessie running Nginx 1.9.3-1 and PHP7-beta3 FPM (this one, to be exact: https://github.com/docker-library/php/blob/master/7.0/fpm/Dockerfile).
Same problem here.. It is only working as Apache module. The problem likely exists somewhere in the
fpm sapi?
I hope this is enough information to find the bug. For now I will stick to using apache2handler,
which seems to be working fine.
------------------------------------------------------------------------
[2015-08-16 01:56:28] steffenbrem at gmail dot com
I can confirm that this issue is not present when using PHP7 and Apache (running as php_mod). Will
try to investigate and check PHP7-FPM on other OS.
------------------------------------------------------------------------
[2015-08-16 01:04:04] steffenbrem at gmail dot com
Note that I use PHP in FastCGI mode and run it as an UNIX socket.
------------------------------------------------------------------------
[2015-08-16 00:59:31] steffenbrem at gmail dot com
Description:
------------
I have noticed a strange bug while using NGinx PPA stable and PHP7 FPM nightly build. When you send
a request containing an Authorization header and after that send a request WITHOUT an Authorization
header, PHP still thinks an Authorization header is present on the request (while it isn't).
This can cause a lot of trouble, especially since it is the Authorization header.
Expected result:
----------------
I expect that when you send a request with an authorization header and then the second time I send a
request without an Authorization header, that for that runtime there is no Authorization header set.
Actual result:
--------------
What is happening now is that the authorization header from the previous request is also passed to
the next requests. Even if you do not provide an Authorization header for the next requests.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=70279&edit=1