Bug #71521 [Opn->Fbk]: session_start floods header with Set-Cookie when called multiple times

Edit report at https://bugs.php.net/bug.php?id=71521&edit=1 ID: 71521 Updated by: yohgaki@php.net Reported by: David dot Gausmann at measX dot com Summary: session_start floods header with Set-Cookie when called multiple times -Status: Open +Status: Feedback Type: Bug Package: Session related Operating System: Windows PHP Version: 7.0.3 Block user comment: N Private report: N New Comment: I've fixed that session module sending multiple set cookie headers, a year ago or so. IIRC. OS/SAPI shouldn't matter. Are you sure you're using PHP7? [yohgaki@dev PHP-7.0]$ ./sapi/cgi/php-cgi <?php session_name('Test'); session_cache_expire(180); session_set_cookie_params(0, '/', '', false, true); for($i = 0; $i < 10000; ++$i) { session_start(); session_write_close(); } ?> X-Powered-By: PHP/7.0.4-dev Set-Cookie: Test=64082c017c50d407647dd29ecb0874e4; path=/; HttpOnly Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-type: text/html; charset=UTF-8 Previous Comments: ------------------------------------------------------------------------ [2016-02-09 13:40:52] laruence@php.net I can not reproduce this... only one cookie header is sent in my box. (php-cgi) ------------------------------------------------------------------------ [2016-02-04 16:07:29] David dot Gausmann at measX dot com Description: ------------ In a productive website of a customer I need to start/stop the session multiple times during the execution of a single PHP script. In some cases the proxy server had thrown HTTP error 502 that the header is too long. I've found out, that session_start always adds a Set-Cookie header, regardless of the fact that there is already exactly the same header line. This bug has already been reported here, but is still unfixed, so I create a new bug report: https://bugs.php.net/bug.php?id=38104 https://bugs.php.net/bug.php?id=31455 Test script: --------------- <?php session_name('Test'); session_cache_expire(180); session_set_cookie_params(0, '/', '', false, true); for($i = 0; $i < 10000; ++$i) { session_start(); session_write_close(); } ?> Expected result: ---------------- Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly (exactly one time) Actual result: -------------- Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly ... (10000 times) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71521&edit=1