note 56324 deleted from function.header by bjori

Note Submitter: grey - greywyvern - com ---- It seems as though the "Location" header in PHP has a special affinity for 3xx level HTTP response codes. Using Linux/Apache and PHP 4.3.9, the following two bits of code will behave exactly alike: <?php header("HTTP/1.1 307 Temporary Redirect"); header("Location: http://www.example.com/error.php"); ?> <?php header("Location: http://www.example.com/error.php"); header("HTTP/1.1 307 Temporary Redirect"); ?> ... redirecting to /error.php with a "307 Temporary Redirect" response code. Other 3xx and 2xx level responses will behave in a similar fashion. However, using other response codes (4xx and 5xx level) causes the output to differ depending on order. <?php header("HTTP/1.1 412 Precondition Failed"); header("Location: http://www.example.com/error.php"); ?> ... will redirect to /error.php with an HTTP response code of "302 Found" while: <?php header("Location: http://www.example.com/error.php"); header("HTTP/1.1 412 Precondition Failed"); ?> ... does the same, but this time sends the "412 Precondition Failed" header as specified. I would make a guess that in the first case, PHP recieves the "Location" header, and upon noting that a 3xx or 2xx level response has not been set (even though a 4xx or 5xx response *has*), sets the "302 Found" to create a "proper" HTTP redirect. In the latter case, PHP sets the "302 Found" header, but it is overwritten by the new response code which appears later in the code. While sending a "Location" header with 4xx and 5xx level responses is unconventional, the spec does not prohibit doing so: http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.30