Bug #72997 [Opn->Asn]: Set-Cookie header lost if we do session_regenerate_id() without setcookie call

Edit report at https://bugs.php.net/bug.php?id=72997&edit=1 ID: 72997 Updated by: yohgaki@php.net Reported by: rmpic30 at gmail dot com Summary: Set-Cookie header lost if we do session_regenerate_id() without setcookie call -Status: Open +Status: Assigned Type: Bug Package: Session related -Operating System: Ubuntu Xenial Xerus 16.04 +Operating System: Irrelevant -PHP Version: 7.0.10 +PHP Version: Irrelevant -Assigned To: +Assigned To: yohgaki Block user comment: N Private report: N New Comment: A little surprised by this bug. Verified. I suppose there is something wrong in header buffer handling. Previous Comments: ------------------------------------------------------------------------ [2016-09-01 20:35:31] rmpic30 at gmail dot com Description: ------------ PHP does not send the Set-Cookie header, if we call session_regenerate_id() AND do not call setcookie() function for adding additional cookies. Here is plain PHP version and Symfony3 & ZF Diactoros versions. Both do not work as expected. Plain PHP version: https://gist.github.com/anonymous/6b4a906273f489e95e2dfac3c247c68c Symfony version: https://gist.github.com/anonymous/88e52bd7876378b0f490ed15d30b43fe How to reproduce (for plain PHP version): 1) Run this script on any web-server. It should return one Set-Cookie header with a new session. 2) Repeat your request with issued session. No extra Set-Cookie headers should be. 3) Run this script with parameter set_cookie with value of your current domain. You will see only ONE Set-Cookie header, header with the new PHPSESSID is lost. Now comment out line 18, and uncomment line 21 in this https://gist.github.com/anonymous/6b4a906273f489e95e2dfac3c247c68c version Repeat all steps again. On step #3 you will see TWO Set-Cookie headers as expected. $ php -v PHP 7.0.10-2+deb.sury.org~xenial+1 (cli) ( NTS ) Copyright (c) 1997-2016 The PHP Group Zend Engine v3.0.0, Copyright (c) 1998-2016 Zend Technologies with Zend OPcache v7.0.10-2+deb.sury.org~xenial+1, Copyright (c) 1999-2016, by Zend Technologies Test script: --------------- Plain PHP version: https://gist.github.com/anonymous/6b4a906273f489e95e2dfac3c247c68c Symfony version: https://gist.github.com/anonymous/88e52bd7876378b0f490ed15d30b43fe Expected result: ---------------- I should see two Set-Cookie headers on step 3. Actual result: -------------- I see only one Set-Cookie header on step 3. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72997&edit=1