Bug #72997 [NEW]: Set-Cookie header lost if we do session_regenerate_id() without setcookie call

From: rmpic30 at gmail dot com Operating system: Ubuntu Xenial Xerus 16.04 PHP version: 7.0.10 Package: Session related Bug Type: Bug Bug description:Set-Cookie header lost if we do session_regenerate_id() without setcookie call Description: ------------ PHP does not send the Set-Cookie header, if we call session_regenerate_id() AND do not call setcookie() function for adding additional cookies. Here is plain PHP version and Symfony3 & ZF Diactoros versions. Both do not work as expected. Plain PHP version: https://gist.github.com/anonymous/6b4a906273f489e95e2dfac3c247c68c Symfony version: https://gist.github.com/anonymous/88e52bd7876378b0f490ed15d30b43fe How to reproduce (for plain PHP version): 1) Run this script on any web-server. It should return one Set-Cookie header with a new session. 2) Repeat your request with issued session. No extra Set-Cookie headers should be. 3) Run this script with parameter set_cookie with value of your current domain. You will see only ONE Set-Cookie header, header with the new PHPSESSID is lost. Now comment out line 18, and uncomment line 21 in this https://gist.github.com/anonymous/6b4a906273f489e95e2dfac3c247c68c version Repeat all steps again. On step #3 you will see TWO Set-Cookie headers as expected. $ php -v PHP 7.0.10-2+deb.sury.org~xenial+1 (cli) ( NTS ) Copyright (c) 1997-2016 The PHP Group Zend Engine v3.0.0, Copyright (c) 1998-2016 Zend Technologies with Zend OPcache v7.0.10-2+deb.sury.org~xenial+1, Copyright (c) 1999-2016, by Zend Technologies Test script: --------------- Plain PHP version: https://gist.github.com/anonymous/6b4a906273f489e95e2dfac3c247c68c Symfony version: https://gist.github.com/anonymous/88e52bd7876378b0f490ed15d30b43fe Expected result: ---------------- I should see two Set-Cookie headers on step 3. Actual result: -------------- I see only one Set-Cookie header on step 3. -- Edit bug report at https://bugs.php.net/bug.php?id=72997&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72997&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72997&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72997&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=72997&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=72997&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=72997&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=72997&r=needscript Try newer version: https://bugs.php.net/fix.php?id=72997&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=72997&r=support Expected behavior: https://bugs.php.net/fix.php?id=72997&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=72997&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=72997&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=72997&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72997&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=72997&r=dst IIS Stability: https://bugs.php.net/fix.php?id=72997&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=72997&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=72997&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=72997&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=72997&r=mysqlcfg