Re: multiline HTTP headers support in header()
| From: | Pierre Joye | Date: | Thu, 03 Jul 2014 06:33:24 +0000 |
| Subject: | Re: multiline HTTP headers support in header() | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-75196@lists.php.net to get a copy of this message | ||
On Jul 3, 2014 2:37 AM, "Solar Designer" <solar@openwall.com> wrote:
>
> Hi,
>
> Please drop multiline HTTP headers support from PHP header() because it
> was never needed in that layer, it is a security risk in combination
> with a certain IE bug, IE didn't support such multiline response headers
> properly anyway, and they are deprecated by RFC 7230:
>
> https://twitter.com/d0znpp/status/483147480843186176
>
> http://lab.onsec.ru/2012/08/php-multiple-headers-bypass-available.html
> http://tools.ietf.org/html/rfc7230#section-3.2.4
>
> I brought this to Pierre Joye's attention on Twitter today, and he
> agrees that "yes it should be removed" and asked me to "drop a mail to
> internals". So I just did.
I confirm and reiterate my +1 here
Thanks for bringing this topic back to internals.
Cheers,
Pierre