[php-src] Issue #24454: Allow distinguishing request-derived values from environment variables in $_SERVER
| From: | shyim | Date: | Tue, 20 Oct 2026 07:53:17 +0000 |
| Subject: | [php-src] Issue #24454: Allow distinguishing request-derived values from environment variables in $_SERVER | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-253042@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/24454
Author: shyim
### Description
## Description
Currently,
$_SERVER contains both request-related values and environment variables, but
there is no reliable way to determine the origin of an individual entry.
For example:
```php
$_SERVER['HTTP_AUTHORIZATION'];
```
Depending on the server and SAPI configuration, this value could originate from an incoming HTTP
Authorization header or from an environment variable named
HTTP_AUTHORIZATION.
Both sources expose the value under the same key without any information about its origin.
This can be problematic for applications and frameworks that need to distinguish request-derived
data from process environment configuration, particularly when making security-sensitive decisions.
## Expected behavior
PHP should provide a reliable mechanism to determine whether a $_SERVER entry
originated from request processing or from the process environment.