Bug #71521 [Opn->Csd]: session_start floods header with Set-Cookie when called multiple times

Edit report at https://bugs.php.net/bug.php?id=71521&edit=1 ID: 71521 Updated by: yohgaki@php.net Reported by: David dot Gausmann at measX dot com Summary: session_start floods header with Set-Cookie when called multiple times -Status: Open +Status: Closed Type: Bug Package: Session related Operating System: Windows PHP Version: 7.0.3 -Assigned To: +Assigned To: yohgaki Block user comment: N Private report: N New Comment: I think this bug is fixed already. Previous Comments: ------------------------------------------------------------------------ [2016-02-10 08:32:53] David dot Gausmann at measX dot com This is strange: I am using the current version of XAMPP for testing (includes PHP 7.0.2). With the script I get this output in the browser (I see that with Firebug): Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly [...] X-Powered-By: PHP/7.0.2 But when I use the php.exe (of the XAMPP directory) in server mode (C:\xampp\php\php.exe -S 127.0.0.1:80), I get the correct output in the browser. Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly X-Powered-By: PHP/7.0.2 So the problem must be somewhere in the communication between PHP and Apache...? Kind Regards David Gausmann ------------------------------------------------------------------------ [2016-02-09 22:53:51] yohgaki@php.net I've fixed that session module sending multiple set cookie headers, a year ago or so. IIRC. OS/SAPI shouldn't matter. Are you sure you're using PHP7? [yohgaki@dev PHP-7.0]$ ./sapi/cgi/php-cgi <?php session_name('Test'); session_cache_expire(180); session_set_cookie_params(0, '/', '', false, true); for($i = 0; $i < 10000; ++$i) { session_start(); session_write_close(); } ?> X-Powered-By: PHP/7.0.4-dev Set-Cookie: Test=64082c017c50d407647dd29ecb0874e4; path=/; HttpOnly Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-type: text/html; charset=UTF-8 ------------------------------------------------------------------------ [2016-02-09 13:40:52] laruence@php.net I can not reproduce this... only one cookie header is sent in my box. (php-cgi) ------------------------------------------------------------------------ [2016-02-04 16:07:29] David dot Gausmann at measX dot com Description: ------------ In a productive website of a customer I need to start/stop the session multiple times during the execution of a single PHP script. In some cases the proxy server had thrown HTTP error 502 that the header is too long. I've found out, that session_start always adds a Set-Cookie header, regardless of the fact that there is already exactly the same header line. This bug has already been reported here, but is still unfixed, so I create a new bug report: https://bugs.php.net/bug.php?id=38104 https://bugs.php.net/bug.php?id=31455 Test script: --------------- <?php session_name('Test'); session_cache_expire(180); session_set_cookie_params(0, '/', '', false, true); for($i = 0; $i < 10000; ++$i) { session_start(); session_write_close(); } ?> Expected result: ---------------- Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly (exactly one time) Actual result: -------------- Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly Set-Cookie: Test=68nh86r3ks6jo6tughb7d3u7a5; path=/; HttpOnly ... (10000 times) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71521&edit=1