Bug #70279 [Com]: HTTP Authorization Header is sometimes passed to newer reqeusts

Edit report at https://bugs.php.net/bug.php?id=70279&edit=1 ID: 70279 Comment by: phofstetter at sensational dot ch Reported by: steffenbrem at gmail dot com Summary: HTTP Authorization Header is sometimes passed to newer reqeusts Status: Open Type: Bug Package: FPM related Operating System: Ubuntu Trusty PHP Version: 7.0Git-2015-08-16 (snap) Block user comment: N Private report: N New Comment: I haven't tested this yet (currently on mobile), but if I had to guess, I would say that this is caused by https://github.com/php/php-src/commit/f20118aa669f9992fee8a64024e623805669391b I'll try without this commit later today and if my suspicions are correct, I'll try to come up with a patch. Previous Comments: ------------------------------------------------------------------------ [2015-09-09 15:37:51] steffen dot hanikel at meinfernbus dot de I can confirm this problem running the PHP-7.0.0 branch. Here's a very simple test case: <?php echo $_SERVER['HTTP_X_TEST']. "\n"; fastcgi_finish_request(); $ curl -H "X-Test: 123" http://test 123 curl http://test 123 I guess this is also an security problem. ------------------------------------------------------------------------ [2015-08-27 05:31:09] david at nnucomputerwhiz dot com Found an easy workaround which may help with troubleshooting. Setting pm.max_requests = 1 in the php-fpm config prevents this from happening since each process handles only 1 request. Obviously not a good idea in a production environment. ------------------------------------------------------------------------ [2015-08-27 02:58:01] yohgaki@php.net Reporter states it's FPM only issue. It sounds like request clean up is not done well in FPM SAPI. ------------------------------------------------------------------------ [2015-08-26 23:45:07] david at nnucomputerwhiz dot com I can confirm this is happening in 7.0.0RC1 too running php-fpm and nginx 1.2.0. It appears to be any http header not just the Authorization header. It's causing problems on some sites because $_SERVER['HTTP_X_REQUESTED_WITH'] sometimes contains 'XMLHttpRequest' even if it wasn't sent in the current request but it was sent in previous requests. The problem is very intermittent and trivial scripts don't seem to reproduce it. ------------------------------------------------------------------------ [2015-08-16 02:29:11] steffenbrem at gmail dot com Tested it on Debian Jessie running Nginx 1.9.3-1 and PHP7-beta3 FPM (this one, to be exact: https://github.com/docker-library/php/blob/master/7.0/fpm/Dockerfile). Same problem here.. It is only working as Apache module. The problem likely exists somewhere in the fpm sapi? I hope this is enough information to find the bug. For now I will stick to using apache2handler, which seems to be working fine. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=70279 -- Edit this bug report at https://bugs.php.net/bug.php?id=70279&edit=1