|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull Requests
Pull requests:
HistoryAllCommentsChangesGit/SVN commits
[2020-02-12 16:50 UTC] miguelxpn2 at gmail dot com
[2020-02-24 05:09 UTC] miguelxpn2 at gmail dot com
[2021-10-11 12:08 UTC] cmb@php.net
-Status: Open
+Status: Closed
-Assigned To:
+Assigned To: cmb
[2021-10-11 12:08 UTC] cmb@php.net
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Fri Oct 24 21:00:01 2025 UTC |
Description: ------------ If there is any header in the http request that contains the string 'host:' in their value before the actual host header the requests ends up being sent with two headers Host, the one specified by the user and the default one that's injected in case the header wasn't present. Test script: --------------- <?php $opts = array( 'http'=>array( 'method'=>"GET", 'header'=>"RandomHeader: localhost:8080\r\n" . "Cookie: foo=bar\r\n" . "Host: testcustomheader \r\n" ) ); $context = stream_context_create($opts); $fp = fopen('http://myserver.com', 'r', false, $context); fpassthru($fp); Expected result: ---------------- The raw headers should only contain the host header specified by the user that was sent in the context. Actual result: -------------- We get a faulty request with two Host headers instead: GET / HTTP/1.0 Host: myserver.com RandomHeader: localhost:8080 Cookie: foo=bar Host: testcustomhostheader