Bug #77780 [PATCH]: "Headers already sent..." when previous connection was aborted

Edit report at https://bugs.php.net/bug.php?id=77780&edit=1 ID: 77780 Patch added by: bukka@php.net Reported by: mp at webfactory dot de Summary: "Headers already sent..." when previous connection was aborted Status: Assigned Type: Bug Package: FPM related Operating System: Ubuntu 18.04.2 LTS PHP Version: 7.2.16 Assigned To: bukka Block user comment: N Private report: N New Comment: The following pull request has been associated: Patch Name: Split SAPI deactivation to module and destroy parts On GitHub: https://github.com/php/php-src/pull/8877 Patch: https://github.com/php/php-src/pull/8877.patch Previous Comments: ------------------------------------------------------------------------ [2022-06-26 13:36:16] bukka@php.net The following pull request has been associated: Patch Name: Separate SAPI deactivating and destroying resources On GitHub: https://github.com/php/php-src/pull/8876 Patch: https://github.com/php/php-src/pull/8876.patch ------------------------------------------------------------------------ [2022-01-28 20:00:01] ryan dot pfenninger at validity dot com This also affects the 7.4 branch. Is there any chance of a fix? ------------------------------------------------------------------------ [2021-08-24 13:45:03] cmb@php.net This looks more like an FPM issue. ------------------------------------------------------------------------ [2021-03-08 12:10:07] kojinob at b-architects dot com Hi, We've encountered the same issue. What we've confirmed so far were, - "ignore_user_abort" = On / Off doesn't matter - If the text (e.g. HTML) has "#include" statement and the text was big enough, the warning message appears. - Even if the text (e.g. HTML) has "#include" statement, if the text was small, the warning message does not appear. - If the text was small and not having "#include" statement, the warning message does not appear. Regards, ------------------------------------------------------------------------ [2019-03-22 10:09:19] mp at webfactory dot de Description: ------------ I am running Apache and forwarding PHP requests to PHP-FPM. In the Apache error logfile as well as in the PHP-FPM log, there are spurious messages as follows: AH01071: Got error 'PHP message: PHP Warning: Unknown: Headers already sent. You cannot change the session module's ini settings at this time in Unknown on line 0\nPHP message: PHP Warning: Unknown: Headers already sent. You cannot change the session module's ini settings at this time in Unknown on line 0\n' I found out that this happens when a PHP-FPM process serves a request and the connection is aborted by the client. Then the *next* request served by this PHP-FPM process will get the above error message. Probably relevant information: - I am forwarding per-vhost configuration settings to PHP-FPM. In Apache, this can be done as follows: ProxyFCGISetEnvIf "true" PHP_VALUE "session.save_path=\"/some/path/per/vhost\" \n session.cookie_secure=\"1\" \n" - ignore_user_abort is set to "Off", the default setting. My guess is that there is some per-connection flag that tracks whether the headers have already been sent, and that this flag is not correctly reset when the script is aborted by a connection reset. Not sure if this is related to PHP-FPM, the SAPI or even a more general problem. Exact PHP version is PHP 7.2.15-0ubuntu0.18.04.1, the one currently provided by Ubuntu 18.04.2 LTS. Test script: --------------- 1. Set up an Apache vhost to use PHP-FPM. Include the following configuration setting to apply PHP settings per vhost, i. e. settings that PHP-FPM has to apply for every single request handled. ProxyFCGISetEnvIf "true" PHP_VALUE "session.save_path=\"/some/path/per/vhost\" \n session.cookie_secure=\"1\" \n" 2. To make sure all requests hit the same PHP-FPM worker process, configure PHP-FPM with pm=static and pm.max_children=1. 3. Make the following scripts available on the webserver: <?php # slow.php print str_repeat('asdfghjkl', 150000); print "\n"; print "done"; --- <?php # noop.php // empty script --- 4. Run the following script to request slow.php, abort the connection, and run noop.php afterwards: <?php $fp = fopen('http://url/to/slow.php', 'r'); fread($fp, 1024); fclose($fp); file_get_contents('http://url/to/noop.php'); --- 5. Observe that the content-length logged by Apache for the slow.php requests is below the 1.3MB actually emitted by the script, but (for me) always larger than the 1024 bytes read by test.php. In practice, values fluctuacte around 100KB. 6. The error message "PHP message: PHP Warning: Unknown: Headers already sent. You cannot change the session module's ini settings at this time in Unknown on line 0" shows up in server and/or PHP-FPM logfiles. 7. Re-configure PHP-FPM to have ignore_user_abort = On. 8. Repeat steps 4-5. The error message from 6. does not appear this time. Expected result: ---------------- No error message should occur and the session configuration should be applied in either case. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=77780&edit=1