php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #43256 wrong behaviour with header()
Submitted: 2007-11-12 00:19 UTC Modified: 2008-10-29 01:00 UTC
Votes:2
Avg. Score:4.0 ± 1.0
Reproduced:2 of 2 (100.0%)
Same Version:2 (100.0%)
Same OS:2 (100.0%)
From: carsten_sttgt at gmx dot de Assigned:
Status: No Feedback Package: IIS related
PHP Version: 5.2.5 OS: Windows_NT
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: carsten_sttgt at gmx dot de
New email:
PHP Version: OS:

 

 [2007-11-12 00:19 UTC] carsten_sttgt at gmx dot de
Description:
------------
Hallo,

in addition to Bug #42969 I've done some more tests. Tere is really something wrong with header() together with IIS.

The behaviour is different, if I use the CGI or ISAPI.

First I must also say: I have no problem to set this header correct with ASP, Perl or Phyton. Regardless if I use CGI or ISAPI. Of course with CGI, the name of such a script must be prepend with "nph-".

As you can see, the only way to set the correct header/code is:
Having PHP as ISAPI and using header() twice. First with the status and second with the location.

This is totally different to Apache, where I must use only one header() with location and status as parameter (Testscript 2).

Especially with IIS/ISAPI, Testscript 2 should also work. Or remove the status parameter at all: No different behaviour on different platforms.

For IIS/CGI the actual result is acceptable.

For IIS/NPH-CGI: It's not working in no way at the moment!

Regards,
Carsten



Reproduce code:
---------------
Testscript 1 (test.php):
------------------------
<?php
header('HTTP/1.0 303 See Other');
header('Location: http://www.example.com/');
?>

Testscript 2 (test.php):
------------------------
<?php
header('Location: http://www.example.com/', true, 303);
?>

Testscript 3 (nph-test.php):
----------------------------
<?php
echo "HTTP/1.0 303 See Other\r\n";
echo "Location: http://www.example.com/\r\n\r\n";
?>


Expected result:
----------------
D:\PHP>pear-request -r 0 -S http://localhost/test.php
GET http://localhost/test.php --> 303 See Other


Actual result:
--------------
Testscript 1, 2 and 3 with nph-cgi:
| D:\PHP>pear-request -r 0 -S http://localhost/nph-test.php
| GET http://localhost/nph-test.php --> ERROR: Malformed response

Testscript 1 with ISAPI:
| D:\PHP>pear-request -r 0 -S http://localhost/test.php
| GET http://localhost/test.php --> 303 See Other

Testscript 1 with CGI:
| D:\PHP>pear-request -r 0 -S http://localhost/test.php
| GET http://localhost/test.php --> 302 Object Moved

Testscript 2 with ISAPI:
| D:\PHP>pear-request -r 0 -S http://localhost/test.php
| GET http://localhost/test.php --> 303 Undescribed

Testscript 2 with CGI:
| D:\PHP>pear-request -r 0 -S http://localhost/test.php
| GET http://localhost/test.php --> 302 Object Moved


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-11-12 11:23 UTC] jani@php.net
What are you using exactly with IIS? PHP FastCGI binary or ISAPI module? (note: Only former is really useful/working properly)
 [2007-11-12 17:59 UTC] carsten_sttgt at gmx dot de
> What are you using exactly with IIS?
> PHP FastCGI binary or ISAPI module?

As you can see in the examples: both. Or in other words: I can't know, if a script is used with ISAPI or CGI on a customer installation.


> note: Only former is really useful/working properly)

But this is only true for PHP. Why? With other scripting languages, I have no problem to set this header via ISAPI.

And with PHP/ISAPI there is only one problem:
I must use first a header() call to set the status, and then I can use header() with location.
| header('HTTP/1.0 303 See Other');
| header('Location: http://www.example.com/');
(The first header() call is normaly only necessary, if I want change the default reason phrase)

But what ever happens in the PHP core during the first header call, should also done from PHP, if I use the status parameter in header() (like it works with Apache):
| header('Location: http://www.example.com/', true, 303);


Regarding PHP/CGI:
A CGI which want set/use it't own headers (not parsed from the server), must have a script name which starts with "nph-" (that's not only true for IIS, also for other webservers). But if the name from a PHP script is e.g. "nph-test.php", there is no correct output at all.
(as before, with other scripting languages, this works without problems.)

(Or all together: With other scripting languages I use the same documented command(s) to set the header on all webservers in the same way. Only with CGI I must rename the script. With PHP the same command does work different on different webserver and nph-CGI does't work at all.)

Regards,
Carsten
 [2007-11-16 12:46 UTC] jani@php.net
what is this set in your php.ini:
cgi.rfc2616_headers = 0

(look in the phpinfo() output!)

 [2007-11-17 12:03 UTC] carsten_sttgt at gmx dot de
> what is this set in your php.ini: cgi.rfc2616_headers = 0

Now you address the NPH-CGI issue. Correct, my first tests was with "0". Now with "1":
| D:\PHP>pear-request -r 0 -S -o http://localhost/phpinfo.php |\
| grep "cgi.rfc2616_headers"
| cgi.rfc2616_headers11

with Testscript 1:
------------------
| D:\PHP>pear-request -r 0 -S http://localhost/nph-test.php
| GET http://localhost/nph-test.php --> 303 See Other

Works now. (thanks for the hint)

with Testscript 2:
------------------
| D:\PHP>pear-request -r 0 -S http://localhost/nph-test.php
| GET http://localhost/nph-test.php --> ERROR: Malformed response

Don't work.

So we have a similar result as with ISAPI. There is only a correct result, if you also explicitly set the "Status" header. Only setting the "Location" header with the code parameter does not work correctly.

Regards,
Carsten
 [2007-11-17 22:20 UTC] jani@php.net
There's also this setting:

; cgi.nph = 1

Try to turn that off / on.
 [2007-11-19 01:27 UTC] carsten_sttgt at gmx dot de
> There's also this setting:
> ; cgi.nph = 1

There is no difference:
| D:\PHP>cat nph-test.php
| <?php
| header('Location: http://www.example.com/', true, 303);
| ?>
|
| D:\PHP>pear-request -r 0 -S -o http://localhost/phpinfo.php |\
| grep -E "cgi.rfc2616_headers|cgi.nph"
| cgi.nph11
| cgi.rfc2616_headers11
|
| D:\PHP>pear-request -r 0 -S http://localhost/nph-test.php
| GET http://localhost/nph-test.php --> ERROR: Malformed response

BTW:
This setting is only available with CGI, but not with ISAPI.

Regards,
Carsten
 [2007-11-19 14:44 UTC] jani@php.net
Okay, I'm a bit confused now. Where are you reporting the bug? In ISAPI or CGI?
 [2007-11-19 14:57 UTC] carsten_sttgt at gmx dot de
> Where are you reporting the bug? In ISAPI or CGI?

Both. With only using this code:
| header('Location: http://www.example.com/', true, 303);

ISAPI does not set the (default) reason phrase.

CGI (NPH) does not return a complete HTTP response message. The status line is missing.
 [2008-10-21 11:18 UTC] jani@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/


 [2008-10-29 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Dec 21 17:01:58 2024 UTC