Bug #71521 [Com]: session_start floods header with Set-Cookie when called multiple times

Edit report at https://bugs.php.net/bug.php?id=71521&edit=1 ID: 71521 Comment by: simon dot seyock at benndorf dot de Reported by: David dot Gausmann at measX dot com Summary: session_start floods header with Set-Cookie when called multiple times Status: Closed Type: Bug Package: Session related Operating System: Windows PHP Version: 7.0.8 Assigned To: yohgaki Block user comment: N Private report: N New Comment: It also happens with the php:7.3-apache container. Previous Comments: ------------------------------------------------------------------------ [2019-09-17 13:51:09] simon dot seyock at benndorf dot de I can reproduce this error in the php:7.2-apache docker container. just create a directory put the test script in there (maybe reduce it to 100) and run the docker container with docker run -d -p 9999:80 --name cookie_error -v "$PWD":/var/www/html php:7.2-apache then you can open the script at port 9999 and observe the multiple set headers. ------------------------------------------------------------------------ [2016-08-29 07:19:24] David dot Gausmann at measX dot com Hello yohgaki, I've tested this with the current XAMPP (Apache/2.4.18 (Win32) OpenSSL/1.0.2e PHP/7.0.8) and the bug still occurs. Have you really fixed something here? Kind Regards David Gausmann ------------------------------------------------------------------------ [2016-08-27 07:04:45] yohgaki@php.net I think this bug is fixed already. ------------------------------------------------------------------------ [2016-02-10 08:32:53] David dot Gausmann at measX dot com This is strange: I am using the current version of XAMPP for testing (includes PHP 7.0.2). With the script I get this output in the browser (I see that with Firebug): Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly [...] X-Powered-By: PHP/7.0.2 But when I use the php.exe (of the XAMPP directory) in server mode (C:\xampp\php\php.exe -S 127.0.0.1:80), I get the correct output in the browser. Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly X-Powered-By: PHP/7.0.2 So the problem must be somewhere in the communication between PHP and Apache...? Kind Regards David Gausmann ------------------------------------------------------------------------ [2016-02-09 22:53:51] yohgaki@php.net I've fixed that session module sending multiple set cookie headers, a year ago or so. IIRC. OS/SAPI shouldn't matter. Are you sure you're using PHP7? [yohgaki@dev PHP-7.0]$ ./sapi/cgi/php-cgi <?php session_name('Test'); session_cache_expire(180); session_set_cookie_params(0, '/', '', false, true); for($i = 0; $i < 10000; ++$i) { session_start(); session_write_close(); } ?> X-Powered-By: PHP/7.0.4-dev Set-Cookie: Test=64082c017c50d407647dd29ecb0874e4; path=/; HttpOnly Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-type: text/html; charset=UTF-8 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=71521 -- Edit this bug report at https://bugs.php.net/bug.php?id=71521&edit=1