Edit report at https://bugs.php.net/bug.php?id=70279&edit=1
ID: 70279
Comment by: steffen dot hanikel at meinfernbus dot de
Reported by: steffenbrem at gmail dot com
Summary: HTTP Authorization Header is sometimes passed to
newer reqeusts
Status: Open
Type: Bug
Package: FPM related
Operating System: Ubuntu Trusty
PHP Version: 7.0Git-2015-08-16 (snap)
Block user comment: N
Private report: N
New Comment:
I can confirm this problem running the PHP-7.0.0 branch.
Here's a very simple test case:
<?php
echo $_SERVER['HTTP_X_TEST']. "\n";
fastcgi_finish_request();
$ curl -H "X-Test: 123" http://test
123
curl http://test
123
I guess this is also an security problem.
Previous Comments:
------------------------------------------------------------------------
[2015-08-27 05:31:09] david at nnucomputerwhiz dot com
Found an easy workaround which may help with troubleshooting.
Setting pm.max_requests = 1 in the php-fpm config prevents this from happening since each process
handles only 1 request. Obviously not a good idea in a production environment.
------------------------------------------------------------------------
[2015-08-27 02:58:01] yohgaki@php.net
Reporter states it's FPM only issue.
It sounds like request clean up is not done well in FPM SAPI.
------------------------------------------------------------------------
[2015-08-26 23:45:07] david at nnucomputerwhiz dot com
I can confirm this is happening in 7.0.0RC1 too running php-fpm and nginx 1.2.0. It appears to be
any http header not just the Authorization header. It's causing problems on some sites because
$_SERVER['HTTP_X_REQUESTED_WITH'] sometimes contains 'XMLHttpRequest' even if it
wasn't sent in the current request but it was sent in previous requests. The problem is very
intermittent and trivial scripts don't seem to reproduce it.
------------------------------------------------------------------------
[2015-08-16 02:29:11] steffenbrem at gmail dot com
Tested it on Debian Jessie running Nginx 1.9.3-1 and PHP7-beta3 FPM (this one, to be exact: https://github.com/docker-library/php/blob/master/7.0/fpm/Dockerfile).
Same problem here.. It is only working as Apache module. The problem likely exists somewhere in the
fpm sapi?
I hope this is enough information to find the bug. For now I will stick to using apache2handler,
which seems to be working fine.
------------------------------------------------------------------------
[2015-08-16 01:56:28] steffenbrem at gmail dot com
I can confirm that this issue is not present when using PHP7 and Apache (running as php_mod). Will
try to investigate and check PHP7-FPM on other OS.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=70279
--
Edit this bug report at https://bugs.php.net/bug.php?id=70279&edit=1