[php-src] Issue #24454: Allow distinguishing request-derived values from environment variables in $_SERVER

From: Date: Tue, 20 Oct 2026 07:53:17 +0000
Subject: [php-src] Issue #24454: Allow distinguishing request-derived values from environment variables in $_SERVER
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-253042@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/24454 Author: shyim ### Description ## Description Currently, $_SERVER contains both request-related values and environment variables, but there is no reliable way to determine the origin of an individual entry. For example: ```php $_SERVER['HTTP_AUTHORIZATION']; ``` Depending on the server and SAPI configuration, this value could originate from an incoming HTTP Authorization header or from an environment variable named HTTP_AUTHORIZATION. Both sources expose the value under the same key without any information about its origin. This can be problematic for applications and frameworks that need to distinguish request-derived data from process environment configuration, particularly when making security-sensitive decisions. ## Expected behavior PHP should provide a reliable mechanism to determine whether a $_SERVER entry originated from request processing or from the process environment.

« previous php.bugs (#253042) next »