multiline HTTP headers support in header()

From: Date: Thu, 03 Jul 2014 00:36:46 +0000
Subject: multiline HTTP headers support in header()
Groups: php.internals 
Request: Send a blank email to internals+get-75180@lists.php.net to get a copy of this message
Hi, Please drop multiline HTTP headers support from PHP header() because it was never needed in that layer, it is a security risk in combination with a certain IE bug, IE didn't support such multiline response headers properly anyway, and they are deprecated by RFC 7230: https://twitter.com/d0znpp/status/483147480843186176 http://lab.onsec.ru/2012/08/php-multiple-headers-bypass-available.html http://tools.ietf.org/html/rfc7230#section-3.2.4 I brought this to Pierre Joye's attention on Twitter today, and he agrees that "yes it should be removed" and asked me to "drop a mail to internals". So I just did. Alexander

« previous php.internals (#75180) next »