CGI SAPI is sending multiple set-cookie headers when session strict mode is on

Hi all, CGI SAPI is sending multiple set-ccokie headers when strict mode is on. [yohgaki@dev test-php-script]$ php-cgi session-strict-mode.php X-Powered-By: PHP/5.5.7 Set-Cookie: PHPSESSID=semtekrsf2l13svihttdgo4hg4; path=/ Set-Cookie: PHPSESSID=vkh55u82icdq80p3i4v3831kc2; path=/ while CLI server and Apache SAPI does not. Current php_session_initialize() is php_session_reset_id(TSRMLS_C); PS(session_status) = php_session_active; /* Read data */ php_session_track_init(TSRMLS_C); if (PS(mod)->s_read(&PS(mod_data), PS(id), &val, &vallen TSRMLS_CC) == FAILURE) { /* Some broken save handler implementation returns FAILURE for non-existent session ID */ /* It's better to rase error for this, but disabled error for better compatibility */ /* php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Failed to read session data: %s (path: %s)", PS(mod)->s_name, PS(save_path)); */ } I've coded above since I cannot change 3rd party session save handler's code. It is better to write as follows (and change PS(session_status) in session read). /* Read data */ php_session_track_init(TSRMLS_C); if (PS(mod)->s_read(&PS(mod_data), PS(id), &val, &vallen TSRMLS_CC) == FAILURE) { /* Some broken save handler implementation returns FAILURE for non-existent session ID */ /* It's better to rase error for this, but disabled error for better compatibility */ /* php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Failed to read session data: %s (path: %s)", PS(mod)->s_name, PS(save_path)); */ } /* Set session ID if session read didn't activated session */ if (PS(session_status) != php_session_active) { php_session_reset_id(TSRMLS_C); PS(session_status) = php_session_active; } Session module code could be changed so that it will not try to set multiple set-cookie headers and works with unmodified 3rd party save handlers. Alternatively, I suppose CGI SAPI could be changed, since CLI server and Apache SAPI does not send multiple set-cookie headers. There are many SAPIs, so I'm wondering which is the best way to fix this issue. Comments are appreciated. Thank you. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net