Bug #71521 [Fbk->Opn]: session_start floods header with Set-Cookie when called multiple times
Edit report at https://bugs.php.net/bug.php?id=71521&edit=1
ID: 71521
User updated by: David dot Gausmann at measX dot com
Reported by: David dot Gausmann at measX dot com
Summary: session_start floods header with Set-Cookie when
called multiple times
-Status: Feedback
+Status: Open
Type: Bug
Package: Session related
Operating System: Windows
PHP Version: 7.0.3
Block user comment: N
Private report: N
New Comment:
This is strange:
I am using the current version of XAMPP for testing (includes PHP 7.0.2).
With the script I get this output in the browser (I see that with Firebug):
Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly
Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly
Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly
Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly
Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly
[...]
X-Powered-By: PHP/7.0.2
But when I use the php.exe (of the XAMPP directory) in server mode (C:\xampp\php\php.exe -S
127.0.0.1:80), I get the correct output in the browser.
Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly
X-Powered-By: PHP/7.0.2
So the problem must be somewhere in the communication between PHP and Apache...?
Kind Regards
David Gausmann
Previous Comments:
------------------------------------------------------------------------
[2016-02-09 22:53:51] yohgaki@php.net
I've fixed that session module sending multiple set cookie headers, a year ago or so. IIRC.
OS/SAPI shouldn't matter. Are you sure you're using PHP7?
[yohgaki@dev PHP-7.0]$ ./sapi/cgi/php-cgi
<?php
session_name('Test');
session_cache_expire(180);
session_set_cookie_params(0, '/', '', false, true);
for($i = 0; $i < 10000; ++$i)
{
session_start();
session_write_close();
}
?>
X-Powered-By: PHP/7.0.4-dev
Set-Cookie: Test=64082c017c50d407647dd29ecb0874e4; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-type: text/html; charset=UTF-8
------------------------------------------------------------------------
[2016-02-09 13:40:52] laruence@php.net
I can not reproduce this... only one cookie header is sent in my box. (php-cgi)
------------------------------------------------------------------------
[2016-02-04 16:07:29] David dot Gausmann at measX dot com
Description:
------------
In a productive website of a customer I need to start/stop the session multiple times during the
execution of a single PHP script.
In some cases the proxy server had thrown HTTP error 502 that the header is too long.
I've found out, that session_start always adds a Set-Cookie header, regardless of the fact that
there is already exactly the same header line.
This bug has already been reported here, but is still unfixed, so I create a new bug report:
https://bugs.php.net/bug.php?id=38104
https://bugs.php.net/bug.php?id=31455
Test script:
---------------
<?php
session_name('Test');
session_cache_expire(180);
session_set_cookie_params(0, '/', '', false, true);
for($i = 0; $i < 10000; ++$i)
{
session_start();
session_write_close();
}
?>
Expected result:
----------------
Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly
(exactly one time)
Actual result:
--------------
Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly
Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly
Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly
Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly
Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly
Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly
...
(10000 times)
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=71521&edit=1
Thread (9 messages)