php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Doc Bug #33225 PHP sends multiple Status headers
Submitted: 2005-06-03 01:56 UTC Modified: 2005-10-23 23:44 UTC
Votes:1
Avg. Score:3.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: phpbugs at thequod dot de Assigned:
Status: Not a bug Package: Documentation problem
PHP Version: 5.0.4 OS: *
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: phpbugs at thequod dot de
New email:
PHP Version: OS:

 

 [2005-06-03 01:56 UTC] phpbugs at thequod dot de
Description:
------------
Multiple "Status" lines get send when    
using "header('Location: url')", which produces an  
additional 302 (REDIRECT) status code.  
    
This causes FastCGI (at least) to produce a 500 Internal    
Server Error:    
FastCGI: comm with server "/path/to/fcgi-starter" aborted:    
error parsing headers: duplicate header 'status'    
  
    
Documentation    
(http://us2.php.net/manual/en/function.header.php) says:    
Note:  The HTTP status header line will always be the    
first sent to the client [[NOT TRUE! - reproduce: echo  
"<?php header('Status: 304'); ?>" | php5/bin/php-fcgi]],  
regardless of the    
actual header() call being the first or not. The status    
may be overridden by calling header() with a new status    
line at any time unless the HTTP headers have already been    
sent [[NOT TRUE! - this bug]].    
    
-----------------------------------    
configure (both PHP5 and PHP4):    
./configure --enable-memory-limit    
--enable-force-cgi-redirect  \    
--enable-track-vars --with-pcre-regex --with-mysql    
--without-sqlite \    
--with-zlib --with-bz2 --enable-mbstring --with-openssl    
--enable-exif \    
--with-dom=shared --with-ttf=shared --with-gd=shared    
--enable-calendar \    
--with-iconv --enable-inline-optimization    
--enable-gd-native-ttf \    
--with-ldap --with-ldap-sasl \    
--with-gettext \    
--without-mm --enable-fastcgi --prefix=/home/daniel/php5    
    

Reproduce code:
---------------
$ cat << "?>" | php5/bin/php-fcgi 
<?php 
header( 'Status: 404' ); 
header( 'Status: 301' ); 
header( 'Location: http://www.example.org' ); 
?> 


Expected result:
----------------
Status: 301  
Content-type: text/html  
X-Powered-By: PHP/5.0.4  
Location: http://www.example.org  
  

Actual result:
--------------
Status: 302 
Content-type: text/html 
X-Powered-By: PHP/5.0.4 
Status: 301 
Location: http://www.example.org 
 

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-06-03 23:18 UTC] sniper@php.net
Here's what I get with Apache2 and your script:

HTTP/1.1 302 Found
Date: Fri, 03 Jun 2005 21:15:54 GMT
Server: Apache/2.0.52 (Fedora)
X-Powered-By: PHP/5.1.0-dev
Status: 301
Location: http://www.example.org
Connection: close
Content-Type: text/html; charset=ISO-8859-1

IMO, this is not a bug in either SAPI. Just documentation issue.

 [2005-06-05 13:45 UTC] phpbugs at thequod dot de
Sniper, please use a FastCGI-compiled PHP-CGI binary and  
don't inspect the Apache output.  
  
If you would have been running php-fastcgi on your Apache2  
server you would've gotten a "Internal server error",  
because fastcgi dies on multiple Status headers. 
 
It's not only a documentation problem, but causes Internal 
Server errors with Apache and fastcgi, because fastcgi is 
very strict about the "There has to be exact one status 
code in the cgi response".
 [2005-06-05 16:59 UTC] nlopess@php.net
Could you please check the last comment please?
And then return the bug to us if needed.

Thanks,
Nuno
 [2005-06-06 00:02 UTC] sniper@php.net
If Apache behaves like that (and CGI), it's not a bug.
Do NOT send multiple status headers if you wish it to work as you expect.

 [2005-06-06 16:40 UTC] vrana@php.net
You can set HTTP response code by header("HTTP/ ") and that's what is documented. "The HTTP status header line will always be the first sent to the client" is pointing to this header("HTTP/ "), not header("Status: ").
 [2005-10-23 23:44 UTC] phpbugs at thequod dot de
In the documentation (at least the german one) it says 
that header( 'HTTP/..' ) and header( 'Status: ..' ) do the 
same.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Wed Feb 05 09:01:30 2025 UTC