Bug #71653 [Opn->Csd]: sometimes wrong/old values appear in $_SERVER['HTTP_ACCEPT']

Edit report at https://bugs.php.net/bug.php?id=71653&edit=1 ID: 71653 User updated by: karim dot scheik at prisma-solutions dot at Reported by: karim dot scheik at prisma-solutions dot at Summary: sometimes wrong/old values appear in $_SERVER['HTTP_ACCEPT'] -Status: Open +Status: Closed Type: Bug Package: Apache2 related Operating System: Linux PHP Version: 7.0.3 Block user comment: N Private report: N New Comment: the problem appears to be Apache's mod_cache storing/caching headers as well Previous Comments: ------------------------------------------------------------------------ [2016-02-23 17:50:28] karim dot scheik at prisma-solutions dot at it seems the whole request is bogus/stale, even user-agent is from the old request: Firefox makes a request and this is what (sometimes) comes back from header('X-User-Agent: "' . $_SERVER['HTTP_USER_AGENT'] . '"'), which is clearly not correct: "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.109 Safari/537.36 OPR/35.0.2066.68 (Edition Campaign 21)" ------------------------------------------------------------------------ [2016-02-23 17:43:40] karim dot scheik at prisma-solutions dot at Description: ------------ apache-2.2.31 and PHP 7.0.3 and 5.6.18, pecl-apcu 5.1.3 on Gentoo Linux 4.1.15 x86-64 tested A thumbnail script is called 36 times from a gallery web page generating and storing a thumbnail using imagick/gd and pecl-apcu and serving it either as webp or jpeg depending on HTTP_ACCEPT. Sometimes (~1 in 200 thumbnails) the script will serve webp to a non-webp browser if it has been loaded/cached in a webp browser before (e.g. go to gallery with Opera/WebKit and then using Firefox). After investigating (echoing back the HTTP_ACCEPT) it appears that the script receives the HTTP_ACCEPT from an older Opera/WebKit (webp) request, even though Firefox console shows it never sent that header. Firefox console shows it sent "Accept: image/png,image/*;q=0.8,*/*;q=0.5" and PHP echos back "X-Accept: image/webp,image/*,*/*;q=0.8" which was sent by Opera/WebKit seconds before that. Maybe OpCache/APCu related? Or some threading/sharing problem? Test script: --------------- <?php $format = isset($_SERVER['HTTP_ACCEPT']) && stripos($_SERVER['HTTP_ACCEPT'], 'image/webp') !== false ? 'webp' : 'jpeg'; // sometimes this is data from an old request of a different browser!!! header('X-Accept: ' . $_SERVER['HTTP_ACCEPT']); // create, output and store (APCu) thumb in $format ?> Expected result: ---------------- $_SERVER['HTTP_ACCEPT'] should contain what the browser actually sent and thus Actual result: -------------- $_SERVER['HTTP_ACCEPT'] sometimes contains a foreign request made by a different browser sometime ago ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71653&edit=1