php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #39984 Response header sent as 302 despite being set to 301
Submitted: 2006-12-29 14:37 UTC Modified: 2007-02-23 14:06 UTC
Votes:25
Avg. Score:2.8 ± 1.8
Reproduced:10 of 12 (83.3%)
Same Version:5 (50.0%)
Same OS:6 (60.0%)
From: marc dot bau at gmx dot net Assigned: edink (profile)
Status: Suspended Package: IIS related
PHP Version: 5.2.1 OS: WinXP
Private report: No CVE-ID: None
View Developer Edit
 [2006-12-29 14:37 UTC] marc dot bau at gmx dot net 
Description:
------------
This code should return a response header of 301, but sends a response header of 302.

I have tested this with PHP 5.1 and 5.2 on IIS with PHP-CGI.

Reproduce code:
---------------
<?php
header("Location: http://example.com", true, 301);
?>

Expected result:
----------------
HTTP Status Code 301

Actual result:
--------------
HTTP Status Code 302

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-12-29 17:30 UTC] tony2001@php.net 
Cannot reproduce with Apache.

HTTP/1.1 301
Date: Fri, 29 Dec 2006 17:29:55 GMT
Server: Apache/1.3.29 (Unix)
X-Powered-By: PHP/5.2.1RC2-dev
Location: http://example.com
Connection: close
Content-Type: text/html
 [2006-12-29 17:59 UTC] marc dot bau at gmx dot net 
This is why is selected "IIS related". I cannot repro this with Apache, too. But under IIS it is broken!
 [2006-12-29 18:03 UTC] tony2001@php.net 
This is why I stated I was using Apache.
Please make sure IIS does not translate 301 to 302.
 [2006-12-29 18:03 UTC] marc dot bau at gmx dot net 
GET /test.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en;q=0.8,en-us;q=0.6,de-de;q=0.4,es;q=0.2
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=m9qi6v871710hj32f7b5cq6317

HTTP/1.x 302 Object Moved
Server: Microsoft-IIS/5.1
Date: Fri, 29 Dec 2006 18:02:03 GMT
Connection: close
Content-Type: text/html
X-Powered-By: PHP/5.2.0
Location: http://example.com
 [2006-12-29 18:05 UTC] marc dot bau at gmx dot net 
What are you talking about regarding "Please make sure IIS does not translate 301 to 302." ?
 [2006-12-29 18:12 UTC] tony2001@php.net 
I mean that IIS might change this code for some reason.
One of the possible ways to check it out would be to install Apache with PHP CGI and verify that it works ok.
Since they share the same code, it would mean that the problem is somewhere else.
 [2006-12-29 18:36 UTC] marc dot bau at gmx dot net 
Installing Apache on Windows makes no sense to me. I know it is working with Apache 2.0 and CGI on a Linux (SuSE 9.3) box.

ASP Code Example - works:

<%@ Language=VBScript %>
<%
Response.Status="301 Moved Permanently"
Response.AddHeader "Location", "http://www.example.com/"
%>

ASP Headers results:

GET /test.asp HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en;q=0.8,en-us;q=0.6,de-de;q=0.4,es;q=0.2
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=m9qi6v871710hj32f7b5cq6317; ASPSESSIONIDQQBCCSTD=MIFPNOKCDKGFBIKNGDIINLMM

HTTP/1.x 301 Moved Permanently
Server: Microsoft-IIS/5.1
Date: Fri, 29 Dec 2006 18:27:01 GMT
X-Powered-By: ASP.NET
Location: http://www.example.com/
Content-Length: 0
Content-Type: text/html
Cache-Control: private


ColdFusion MX 7.02 Example - Code:

<CFHEADER statusCode="301" statusText="Moved Permanently"> 
<CFHEADER name="Location" value="http://www.example.com/">


CFMX Header Results:

GET /test.cfm HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en;q=0.8,en-us;q=0.6,de-de;q=0.4,es;q=0.2
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=m9qi6v871710hj32f7b5cq6317; ASPSESSIONIDQQBCCSTD=MIFPNOKCDKGFBIKNGDIINLMM

HTTP/1.x 301 Moved Permanently
Server: Microsoft-IIS/5.1
Date: Fri, 29 Dec 2006 18:33:27 GMT
X-Powered-By: ASP.NET
Connection: close
Set-Cookie: CFID=3396;expires=Fri, 12-Jan-2007 18:33:27 GMT;path=/
Set-Cookie: CFTOKEN=156ca9b801cf2d95%2DCF7CD840%2DBCDB%2D4EA9%2D271106C3DB1FE210;expires=Fri, 12-Jan-2007 18:33:27 GMT;path=/
Set-Cookie: JSESSIONID=e0307f68472e511136a6;path=/
Location: http://www.example.com/
Content-Language: de-DE
Content-Type: text/html; charset=UTF-8


All on the same machine this PHP 5.2 is installed, too. Now - i think - IIS is not the cause of this bug.
 [2006-12-29 19:16 UTC] marc dot bau at gmx dot net 
same results with ISAPI Plugin php5isapi.dll:

GET /test.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en;q=0.8,en-us;q=0.6,de-de;q=0.4,es;q=0.2
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=m9qi6v871710hj32f7b5cq6317; ASPSESSIONIDQQBCCSTD=MIFPNOKCDKGFBIKNGDIINLMM; CFID=3396; CFTOKEN=156ca9b801cf2d95%2DCF7CD840%2DBCDB%2D4EA9%2D271106C3DB1FE210; JSESSIONID=e0307f68472e511136a6

HTTP/1.x 302 Object Moved
Server: Microsoft-IIS/5.1
Date: Fri, 29 Dec 2006 19:15:30 GMT
Connection: close
Content-Type: text/html
X-Powered-By: PHP/5.2.0
Location: http://example.com
 [2006-12-30 13:22 UTC] rrichards@php.net 
Please try using this CVS snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5.2-win32-latest.zip

Using the latests snaps I get: HTTP/1.1 301 Undescribed
from both IIS 5.1 and IIS 7.
 [2006-12-30 21:23 UTC] marc dot bau at gmx dot net 
hi. i've tested this and nothing is changed. I set a 301 and get a 302.


HTTP/1.x 302 Object Moved
Server: Microsoft-IIS/5.1
Date: Sat, 30 Dec 2006 21:22:05 GMT
Connection: close
Content-Type: text/html
X-Powered-By: PHP/5.2.1RC2-dev
Location: http://www.example.com
 [2006-12-31 19:22 UTC] iliaa@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 [2007-01-01 11:12 UTC] marc dot bau at gmx dot net 
Thank you. I will test the latest Snapshot.

Are you able to backport this bugfix? I think this is very important and critical bug for older versions, too.
 [2007-01-01 11:28 UTC] marc dot bau at gmx dot net 
i'm sorry but i must reopen the case. i tested with snapshot php5.2-win32-200701010730 and i got this:

Isn't this the CVS Version you talked about?


HTTP/1.x 302 Object Moved
Server: Microsoft-IIS/5.1
Date: Mon, 01 Jan 2007 11:26:59 GMT
Connection: close
Content-Type: text/html
X-Powered-By: PHP/5.2.1RC2-dev
Location: http://www.example.com
 [2007-01-01 11:49 UTC] marc dot bau at gmx dot net 
same with php6.0-win32-200701010930:

HTTP/1.x 302 Object Moved
Server: Microsoft-IIS/5.1
Date: Mon, 01 Jan 2007 11:47:42 GMT
Connection: close
Content-Type: text/html
X-Powered-By: PHP/6.0.0-dev
Location: http://www.example.com
 [2007-01-01 16:17 UTC] iliaa@php.net 
you need to use the 5.2 CVS snapshot
 [2007-01-01 16:22 UTC] marc dot bau at gmx dot net 
But i have used the Snapshot php5.2-win32-200701010730 !?
 [2007-01-01 16:32 UTC] iliaa@php.net 
Then it is probably due to IIS overwriting the Status code. 
Based on the current code in the CVS right now PHP sends the 
redirect code set by your application.
 [2007-01-01 16:50 UTC] marc dot bau at gmx dot net 
But this won't help me anything if you tell me it should be fixed and it isn't. You should test this on IIS, while it is not working as expected and i cannot fix this myself. 

So - this problem is OPEN until the bug is really fixed. I don't know why your are closing it until it is working.
 [2007-01-01 16:53 UTC] iliaa@php.net 
From the PHP end of things the issue is resolved, if IIS does 
not properly handle the Status header in the event of 
redirects, that's hardly a PHP problem, no?
 [2007-01-01 17:03 UTC] marc dot bau at gmx dot net 
If Perl, ColdFusion and ASP Pages are correct and PHP not, what do you think is wrong?

I think PHP! Maybe there is something wrong in the way how the status is set or how the status is transfered to IIS... i don't know if there is something special in IIS, but it looks like a PHP Bug, while all other script languages are correct.
 [2007-01-11 10:02 UTC] tony2001@php.net 
Edin, could you plz verify if this problem is still valid?
 [2007-02-18 12:05 UTC] marc dot bau at gmx dot net 
Additional to this a header('HTTP/1.0 404 Not Found') produces a "404 OK".
 [2007-02-19 23:23 UTC] edink@php.net 
Seems that there is no way a CGI script can convince IIS to output something else than 302 response if you have location header.

Same IIS using Microsofts latest FCGI isapi has no problems with PHP outputing correct status code.

I recommend that you switch to that instead of using raw cgi, the perfomance icrease is dramatic as well.

http://www.iis.net/default.aspx?tabid=1000051
 [2007-02-23 13:28 UTC] marc dot bau at gmx dot net 
i wonder why there shouldn't be a way to handle this. 

As one example ActiveState (www.activestate.com) Perl have a CGI version and this works well, too. You should spend some time on the Perl Code, maybe there is a small trick inside.
 [2007-02-23 13:41 UTC] marc dot bau at gmx dot net 
Have a look to this headers. "Undescribed" is are wrong, too. I tryed to use "php5isapi.dll" for PHP extension.


GET /test.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en;q=0.8,en-us;q=0.6,de-de;q=0.4,es;q=0.2
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=nihrgij25siffg5r9dbr17boq5

HTTP/1.x 301 Undescribed
Server: Microsoft-IIS/5.1
Date: Fri, 23 Feb 2007 13:38:19 GMT
X-Powered-By: ASP.NET, PHP/5.2.1
Connection: close
Location: http://www.example.com
Content-Type: text/html
 [2007-02-23 14:06 UTC] marc dot bau at gmx dot net 
And this comes to me with FastCGI from the URL you provided. Wrong in a different way - and buggy again. Any way to get this bug really fixed?


HTTP/1.x 301 OK
Server: Microsoft-IIS/5.1
Date: Fri, 23 Feb 2007 14:04:43 GMT
X-Powered-By: ASP.NET, PHP/5.2.1
Connection: close
Location: http://www.example.com
Content-Type: text/html
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Sat Nov 01 04:00:02 2025 UTC