Bug #76331 [Opn]: Location header overrides Content-Type

Edit report at https://bugs.php.net/bug.php?id=76331&edit=1 ID: 76331 User updated by: Andy_Schmidt at HM-Software dot com Reported by: Andy_Schmidt at HM-Software dot com Summary: Location header overrides Content-Type Status: Open Type: Bug Package: HTTP related PHP Version: 7.2.5 Assigned To: cmb Block user comment: N Private report: N New Comment: >> spam2@rhsoft.net: ...should not contain any http body at all << Automatic redirection is NOT a requirement, moreover, inclusion of a payload IS explicitly mentioned as being common - exactly the opposite of your opinion. Please note https://tools.ietf.org/html/rfc7231#section-6.4.2: "The server SHOULD generate a Location header field in the response containing a preferred URI reference for the new permanent URI. The user agent MAY use the Location field value for automatic redirection. The server's response payload usually contains a short hypertext note with a hyperlink to the new URI(s)." Previous Comments: ------------------------------------------------------------------------ [2018-05-11 20:34:08] Andy_Schmidt at HM-Software dot com PS: It is also possible to use redirect status 301/302/307 and NOT include a "Location: " header. I've heard of cases where this is used to indicate that the current URL is no longer valid, but automatic forwarding is NOT wanted. Instead, content is displayed that might offer up a number of alternative links. And, of course, that content might be served up in whatever Content-Type DIFFERENT from the "text/html" that currently is being hard-substituted. ------------------------------------------------------------------------ [2018-05-11 20:30:37] Andy_Schmidt at HM-Software dot com >> spam2@rhsoft.net: ...should not contain any http body at all << I respect your opinion, however, this is governed by RFCs, which states precisely the OPPOSITE: "Unless the request method was HEAD, the entity of the response SHOULD contain a short hypertext note with a hyperlink to the new URI(s)." (https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html) This allows for clients that do NOT perform an automatic redirect. In fact there are scenarios (e.g., request was not "GET" or "HEAD") where the automatic redirect MUST NO occur! ------------------------------------------------------------------------ [2018-05-11 20:21:14] spam2 at rhsoft dot net WTF - a redirect don't need whatever content-type because it should not contain any http body at all ------------------------------------------------------------------------ [2018-05-11 19:37:51] Andy_Schmidt at HM-Software dot com SAPI is standard IIS 8.5 FastCGI. Using: header( 'Location: /transient/media/3315-234_a438fc6e0bd719703694e7bfc0b1392ecbb7a6a6_S-2.jpeg', FALSE, 307 ); did NOT alter the outcome. Also, disabling XDEBUG did not have any effect. ------------------------------------------------------------------------ [2018-05-11 16:40:40] cmb@php.net This appears to be SAPI related, since I get the specified Content-Type header. Which SAPI do you use? Also please check whether it makes a difference, if you set the $http_response_code via header() instead of using http_response_code() explicitly. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=76331 -- Edit this bug report at https://bugs.php.net/bug.php?id=76331&edit=1