php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Doc Bug #32414 session_start(): Cannot send session cache limiter
Submitted: 2005-03-22 17:38 UTC Modified: 2005-03-23 12:49 UTC
From: d dot geels at grape dot ru Assigned:
Status: Closed Package: Documentation problem
PHP Version: 4.3.10, also 5 OS: any
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: d dot geels at grape dot ru
New email:
PHP Version: OS:

 

 [2005-03-22 17:38 UTC] d dot geels at grape dot ru
Description:
------------
The problem described already in user contributed noted in documentation. Strange, that it is not yet fixed...
Also problem mentioned in http://bugs.php.net/bug.php?id=11213
==================================
laacz at laacz dot lv (28-Oct-2004 03:37)

If You are not using cookies to store session_id's, that does not mean, that session_start() will not send any headers at all. It still sends cache controlling information to user. For example:
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Even, if You set cache_limiter to none (via ini_set('session.use_cookies', 0) or ini_set('session.cache_limiter', 'none')), session_start() still tries to send empty headers and that causes error message "Cannot send session cache limiter - headers already sent". So, use output buffering, if You need to output something before session_start(). 
==================================
even session_cache_limiter('none') doesn't work

In my case, problem is that I call session_start(), then session_write_close() in the beginning, then send data, then call session_start(), then session_write_close() in the function, registered on shutdown.
There are two reasons, why I do so:
1) there are several processes, that access same session (I use md5($_SERVER['REMOTE_ADDR']) as session_id)
2) I can't buffer output at all. Amount of data is very large, it is a file being downloaded. It must be sent ASAP.

Reproduce code:
---------------
if(!empty($_SERVER['HTTP_RANGE'])){
	$sid = md5($_SERVER['REMOTE_ADDR']);
	ini_set('session.use_cookies', 0);
	session_cache_limiter('public'); // for IE "Open" bug
	session_id($sid);
	session_start(); //this one starts normally
	//check, if this download thread is permitted or not
	if(!empty($_SESSION['file_'.$file_id]) && $_SESSION['file_'.$file_id] >= MAX_DOWNLOAD_THREADS){
		header('HTTP/1.1 403 Forbidden', true, 403);
		exit;
	}elseif(!isset($_SESSION['file_'.$file_id])) $_SESSION['file_'.$file_id] = 0;
	$_SESSION['file_'.$file_id]++;
	session_write_close();
	//close session ASAP, because else other processes would be blocked

	//this function will decrement threads counter...
	function decrementCounter($sid, $file_id)
	{
//this must help us evade "Warning:  session_start(): Cannot send session cache limiter - headers already sent"
		session_cache_limiter('none');

		session_id($sid);
		session_start(); // this is line #45
		//decrement threads counter
		$_SESSION['file_'.$file_id]--;
		session_write_close();
		//close session ASAP
	}

	//... when script finished
	register_shutdown_function('decrementCounter', $sid, $file_id);
}

Expected result:
----------------
No warnings in log file.

Actual result:
--------------
[Tue Mar 22 18:32:08 2005] [error] PHP Warning:  session_start(): Cannot send session cache limiter - headers already sent (output started at /home/httpd/pantech/htdocs/file.php:144) in /home/httpd/pantech/htdocs/file.php on line 45

reproduced always, when user downloading a file

line 144 sends data to client:
echo fread( $fp, $size > READ_BLOCK_SIZE ? READ_BLOCK_SIZE : $size );


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-03-22 18:46 UTC] d dot geels at grape dot ru
Tiny example, that always reproduces the bug.

<?
ini_set('session.use_cookies', 0);
session_id('1234');
session_cache_limiter('public');
session_start();
session_write_close();
?>
text
<?
function a(){
  session_cache_limiter('none');
  session_start();
  session_write_close();
}

register_shutdown_function('a');
?>

If just call a() at the end -- no warnings, if a() called at shutdown -- warning issued.
 [2005-03-22 22:56 UTC] sniper@php.net
This is actually just documentation problem:
You can't send any headers from a register_shutdown_function()  call. Or use any functions in such function that might send headers..such as almost any session function.
 
 [2005-03-23 01:10 UTC] d dot geels at grape dot ru
The problem is that session_start() tries to send headers, but it must not.

Try 'curl -v <url to above example>' and just call function a() at the end, without registering shutdown function, you'll see, that session_start() doesn't send any headers if second call to session_cache_limiter has parameter 'none'. So, why does it complain, when called from shutdown function? That is the bug actually.
 [2005-03-23 11:43 UTC] vrana@php.net
This bug has been fixed in the documentation's XML sources. Since the
online and downloadable versions of the documentation need some time
to get updated, we would like to ask you to be a bit patient.

Thank you for the report, and for helping us make our documentation better.

"Shutdown function is called during the script shutdown so headers are always already sent."
 [2005-03-23 12:08 UTC] d dot geels at grape dot ru
No, you misunderstood me: I want to say, that problem is that session_start() ALWAYS tries to send headers. Even if all reasons for sending are eliminated by ini_set('session.use_cookies', 0) and session_cache_limiter('none'), it still tries to send empty headers, which cause bug subject warning.
 [2005-03-23 12:35 UTC] tony2001@php.net
Nope.
Use ini_set('session.use_cookies', false); to turn off cookie sending and session_cache_limiter(''); to not use ANY cache limiter, because 'none' is being sent too.
Please, do not reclassify existing and already closed bugs, fill a new report if you feel that there is *really* a bug. 
For further questions please use support forums and mailing lists.

 [2005-03-23 12:49 UTC] d dot geels at grape dot ru
Sorry.

>session_cache_limiter(''); to not use ANY cache limiter, because 'none' is being sent too

So, this is the problem? Documentation says nothing about '', only 'none' is documented.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri May 10 03:01:30 2024 UTC