php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #77780 "Headers already sent..." when previous connection was aborted
Submitted: 2019-03-22 10:09 UTC Modified: 2022-06-14 20:06 UTC
Votes:6
Avg. Score:3.2 ± 0.9
Reproduced:5 of 5 (100.0%)
Same Version:2 (40.0%)
Same OS:2 (40.0%)
From: mp at webfactory dot de Assigned: bukka (profile)
Status: Closed Package: FPM related
PHP Version: 7.2.16 OS: Ubuntu 18.04.2 LTS
Private report: No CVE-ID: None
 [2019-03-22 10:09 UTC] mp at webfactory dot de
Description:
------------
I am running Apache and forwarding PHP requests to PHP-FPM. 

In the Apache error logfile as well as in the PHP-FPM log, there are spurious messages as follows:

AH01071: Got error 'PHP message: PHP Warning:  Unknown: Headers already sent. You cannot change the session module's ini settings at this time in Unknown on line 0\nPHP message: PHP Warning:  Unknown: Headers already sent. You cannot change the session module's ini settings at this time in Unknown on line 0\n'

I found out that this happens when a PHP-FPM process serves a request and the connection is aborted by the client. Then the *next* request served by this PHP-FPM process will get the above error message. 

Probably relevant information:

- I am forwarding per-vhost configuration settings to PHP-FPM. In Apache, this can be done as follows:

ProxyFCGISetEnvIf "true" PHP_VALUE "session.save_path=\"/some/path/per/vhost\" \n session.cookie_secure=\"1\" \n"

- ignore_user_abort is set to "Off", the default setting.

My guess is that there is some per-connection flag that tracks whether the headers have already been sent, and that this flag is not correctly reset when the script is aborted by a connection reset. Not sure if this is related to PHP-FPM, the SAPI or even a more general problem. 

Exact PHP version is PHP 7.2.15-0ubuntu0.18.04.1, the one currently provided by Ubuntu 18.04.2 LTS.

Test script:
---------------
1. Set up an Apache vhost to use PHP-FPM. Include the following configuration setting to apply PHP settings per vhost, i. e. settings that PHP-FPM has to apply for every single request handled.

ProxyFCGISetEnvIf "true" PHP_VALUE "session.save_path=\"/some/path/per/vhost\" \n session.cookie_secure=\"1\" \n"

2. To make sure all requests hit the same PHP-FPM worker process, configure PHP-FPM with pm=static and pm.max_children=1.

3. Make the following scripts available on the webserver:

<?php # slow.php

print str_repeat('asdfghjkl', 150000);
print "\n";
print "done";

---

<?php # noop.php 
// empty script

---

4. Run the following script to request slow.php, abort the connection, and run noop.php afterwards:

<?php

$fp = fopen('http://url/to/slow.php', 'r');
fread($fp, 1024);
fclose($fp);
file_get_contents('http://url/to/noop.php');

---

5. Observe that the content-length logged by Apache for the slow.php requests is below the 1.3MB actually emitted by the script, but (for me) always larger than the 1024 bytes read by test.php. In practice, values fluctuacte around 100KB.

6. The error message "PHP message: PHP Warning:  Unknown: Headers already sent. You cannot change the session module's ini settings at this time in Unknown on line 0" shows up in server and/or PHP-FPM logfiles.

7. Re-configure PHP-FPM to have ignore_user_abort = On. 

8. Repeat steps 4-5. The error message from 6. does not appear this time.


Expected result:
----------------
No error message should occur and the session configuration should be applied in either case.


Patches

Pull Requests

Pull requests:

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2021-03-08 12:10 UTC] kojinob at b-architects dot com
Hi,

We've encountered the same issue.

What we've confirmed so far were,

- "ignore_user_abort" = On / Off doesn't matter
- If the text (e.g. HTML) has "#include" statement and the text was big enough, the warning message appears.
- Even if the text (e.g. HTML) has "#include" statement, if the text was small, the warning message does not appear.
- If the text was small and not having "#include" statement, the warning message does not appear.

Regards,
 [2021-08-24 13:45 UTC] cmb@php.net
-Package: Session related +Package: FPM related
 [2021-08-24 13:45 UTC] cmb@php.net
This looks more like an FPM issue.
 [2022-01-28 20:00 UTC] ryan dot pfenninger at validity dot com
This also affects the 7.4 branch.  Is there any chance of a fix?
 [2022-06-14 20:06 UTC] bukka@php.net
-Status: Open +Status: Assigned -Assigned To: +Assigned To: bukka
 [2022-06-26 13:36 UTC] bukka@php.net
The following pull request has been associated:

Patch Name: Separate SAPI deactivating and destroying resources
On GitHub:  https://github.com/php/php-src/pull/8876
Patch:      https://github.com/php/php-src/pull/8876.patch
 [2022-06-26 14:55 UTC] bukka@php.net
The following pull request has been associated:

Patch Name: Split SAPI deactivation to module and destroy parts
On GitHub:  https://github.com/php/php-src/pull/8877
Patch:      https://github.com/php/php-src/pull/8877.patch
 [2022-08-29 21:35 UTC] git@php.net
Automatic comment on behalf of bukka
Revision: https://github.com/php/php-src/commit/3503b1daa265777588b3219b82219a0056675ca0
Log: Fix bug #77780: &quot;Headers already sent&quot; when previous connection was aborted
 [2022-08-29 21:35 UTC] git@php.net
-Status: Assigned +Status: Closed
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Nov 21 10:01:29 2024 UTC