Bug #71653 [NEW]: sometimes wrong/old values appear in $_SERVER['HTTP_ACCEPT']

From: karim dot scheik at prisma-solutions dot at Operating system: Linux PHP version: 7.0.3 Package: Apache2 related Bug Type: Bug Bug description:sometimes wrong/old values appear in $_SERVER['HTTP_ACCEPT'] Description: ------------ apache-2.2.31 and PHP 7.0.3 and 5.6.18, pecl-apcu 5.1.3 on Gentoo Linux 4.1.15 x86-64 tested A thumbnail script is called 36 times from a gallery web page generating and storing a thumbnail using imagick/gd and pecl-apcu and serving it either as webp or jpeg depending on HTTP_ACCEPT. Sometimes (~1 in 200 thumbnails) the script will serve webp to a non-webp browser if it has been loaded/cached in a webp browser before (e.g. go to gallery with Opera/WebKit and then using Firefox). After investigating (echoing back the HTTP_ACCEPT) it appears that the script receives the HTTP_ACCEPT from an older Opera/WebKit (webp) request, even though Firefox console shows it never sent that header. Firefox console shows it sent "Accept: image/png,image/*;q=0.8,*/*;q=0.5" and PHP echos back "X-Accept: image/webp,image/*,*/*;q=0.8" which was sent by Opera/WebKit seconds before that. Maybe OpCache/APCu related? Or some threading/sharing problem? Test script: --------------- <?php $format = isset($_SERVER['HTTP_ACCEPT']) && stripos($_SERVER['HTTP_ACCEPT'], 'image/webp') !== false ? 'webp' : 'jpeg'; // sometimes this is data from an old request of a different browser!!! header('X-Accept: ' . $_SERVER['HTTP_ACCEPT']); // create, output and store (APCu) thumb in $format ?> Expected result: ---------------- $_SERVER['HTTP_ACCEPT'] should contain what the browser actually sent and thus Actual result: -------------- $_SERVER['HTTP_ACCEPT'] sometimes contains a foreign request made by a different browser sometime ago -- Edit bug report at https://bugs.php.net/bug.php?id=71653&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71653&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71653&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71653&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=71653&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=71653&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=71653&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=71653&r=needscript Try newer version: https://bugs.php.net/fix.php?id=71653&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=71653&r=support Expected behavior: https://bugs.php.net/fix.php?id=71653&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=71653&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=71653&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=71653&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71653&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=71653&r=dst IIS Stability: https://bugs.php.net/fix.php?id=71653&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=71653&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=71653&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=71653&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=71653&r=mysqlcfg