Bug #71521 [NEW]: session_start floods header with Set-Cookie when called multiple times

From: David dot Gausmann at measX dot com Operating system: Windows PHP version: 7.0.3 Package: Session related Bug Type: Bug Bug description:session_start floods header with Set-Cookie when called multiple times Description: ------------ In a productive website of a customer I need to start/stop the session multiple times during the execution of a single PHP script. In some cases the proxy server had thrown HTTP error 502 that the header is too long. I've found out, that session_start always adds a Set-Cookie header, regardless of the fact that there is already exactly the same header line. This bug has already been reported here, but is still unfixed, so I create a new bug report: https://bugs.php.net/bug.php?id=38104 https://bugs.php.net/bug.php?id=31455 Test script: --------------- <?php session_name('Test'); session_cache_expire(180); session_set_cookie_params(0, '/', '', false, true); for($i = 0; $i < 10000; ++$i) { session_start(); session_write_close(); } ?> Expected result: ---------------- Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly (exactly one time) Actual result: -------------- Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly ... (10000 times) -- Edit bug report at https://bugs.php.net/bug.php?id=71521&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71521&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71521&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71521&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=71521&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=71521&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=71521&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=71521&r=needscript Try newer version: https://bugs.php.net/fix.php?id=71521&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=71521&r=support Expected behavior: https://bugs.php.net/fix.php?id=71521&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=71521&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=71521&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=71521&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71521&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=71521&r=dst IIS Stability: https://bugs.php.net/fix.php?id=71521&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=71521&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=71521&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=71521&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=71521&r=mysqlcfg