Bug #71521 [Com]: session_start floods header with Set-Cookie when called multiple times

Edit report at https://bugs.php.net/bug.php?id=71521&edit=1 ID: 71521 Comment by: nanne at huiges dot nl Reported by: David dot Gausmann at measX dot com Summary: session_start floods header with Set-Cookie when called multiple times Status: Closed Type: Bug Package: Session related Operating System: Windows PHP Version: 7.0.8 Assigned To: yohgaki Block user comment: N Private report: N New Comment: This bug is set as closed because yohgaki remarked it was fixed. The example by simon clearly shows that years later it still occurs, so I suppose this should be opened, as well as the other bugs referenced. I can _not_ reproduce this with an nginx/fpm combination but the docker example mentioned above clearly shows the issue for 7.2 and testing it with the same command but the image php:7.4-apache also gives the error. It could be a fpm vs mod-php issue? example with the provided test script (but with less iterations) ---------------- $ docker run -d -p 9999:80 --name cookie_error -v "$PWD":/var/www/html php:7.4-apache $ curl http://127.0.0.1:9999/test_script.php -v* Trying 127.0.0.1... * Connected to 127.0.0.1 (127.0.0.1) port 9999 (#0) > GET /test_script.php HTTP/1.1 > Host: 127.0.0.1:9999 > User-Agent: curl/7.47.0 > Accept: */* > < HTTP/1.1 200 OK < Date: Tue, 30 Jun 2020 13:39:49 GMT < Server: Apache/2.4.38 (Debian) < X-Powered-By: PHP/7.4.7 < Set-Cookie: Test=23d3c1c313718547312376035819a63e; path=/; HttpOnly < Expires: Thu, 19 Nov 1981 08:52:00 GMT < Cache-Control: no-store, no-cache, must-revalidate < Pragma: no-cache < Set-Cookie: Test=23d3c1c313718547312376035819a63e; path=/; HttpOnly < Set-Cookie: Test=23d3c1c313718547312376035819a63e; path=/; HttpOnly < Set-Cookie: Test=23d3c1c313718547312376035819a63e; path=/; HttpOnly < Set-Cookie: Test=23d3c1c313718547312376035819a63e; path=/; HttpOnly < Content-Length: 0 < Content-Type: text/html; charset=UTF-8 < * Connection #0 to host 127.0.0.1 left intact Previous Comments: ------------------------------------------------------------------------ [2019-09-17 13:59:20] simon dot seyock at benndorf dot de It also happens with the php:7.3-apache container. ------------------------------------------------------------------------ [2019-09-17 13:51:09] simon dot seyock at benndorf dot de I can reproduce this error in the php:7.2-apache docker container. just create a directory put the test script in there (maybe reduce it to 100) and run the docker container with docker run -d -p 9999:80 --name cookie_error -v "$PWD":/var/www/html php:7.2-apache then you can open the script at port 9999 and observe the multiple set headers. ------------------------------------------------------------------------ [2016-08-29 07:19:24] David dot Gausmann at measX dot com Hello yohgaki, I've tested this with the current XAMPP (Apache/2.4.18 (Win32) OpenSSL/1.0.2e PHP/7.0.8) and the bug still occurs. Have you really fixed something here? Kind Regards David Gausmann ------------------------------------------------------------------------ [2016-08-27 07:04:45] yohgaki@php.net I think this bug is fixed already. ------------------------------------------------------------------------ [2016-02-10 08:32:53] David dot Gausmann at measX dot com This is strange: I am using the current version of XAMPP for testing (includes PHP 7.0.2). With the script I get this output in the browser (I see that with Firebug): Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly [...] X-Powered-By: PHP/7.0.2 But when I use the php.exe (of the XAMPP directory) in server mode (C:\xampp\php\php.exe -S 127.0.0.1:80), I get the correct output in the browser. Set-Cookie: Test=q9s49o455gn4jeu75nht01knj6; path=/; HttpOnly X-Powered-By: PHP/7.0.2 So the problem must be somewhere in the communication between PHP and Apache...? Kind Regards David Gausmann ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=71521 -- Edit this bug report at https://bugs.php.net/bug.php?id=71521&edit=1