php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #25044 header("Location:") changing HTTP status
Submitted: 2003-08-11 12:10 UTC Modified: 2003-08-11 14:41 UTC
From: seairth at cox dot net Assigned: helly
Status: Closed Package: HTTP related
PHP Version: 4.3.3-RC3 OS: *
Private report: No CVE-ID:
 [2003-08-11 12:10 UTC] seairth at cox dot net
Description:
------------
When setting the "Location" HTTP header using the header() function, PHP automatically changes the HTTP response status to "302 Found".  However, there are several other legitimate status codes that use the Location header.  These codes include 201, 301, 303, 305, and 307 (according to the HTTP 1.1 spec).  When one of these status codes is already set, setting the Location header should not change it.

Note: there is a workaround.  (re)Set the status after setting the Location header.  However, this is not a reasonable solution.  For those codes listed above, it should not matter whether the status is set before or after the Location header.

It may even be appropriate to not change the status for any value other than 200 (the default).  As a result, if a user explicitly sets the status to something other than 200, then setting the Location header should not change that value again (even if the combination of the status and header do not make sense).  The reasoning here is that HTTP status codes are extensible, meaning that new specifications can add new status codes that may use the Location header.  If only testing for the above list, new codes would be overlooked and therefore automatically changed.

Reproduce code:
---------------
header('HTTP/1.1 201 Created');
header("Location: http://www.php.net/");



Expected result:
----------------
HTTP Response:

HTTP/1.1 201 Created
Location: http://www.php.net/

Actual result:
--------------
HTTP Response:

HTTP/1.0 302 Found
Location: http://www.php.net/

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-08-11 14:41 UTC] helly@php.net
This bug has been fixed in CVS.

In case this was a PHP problem, snapshots of the sources are packaged
every three hours; this change will be in the next snapshot. You can
grab the snapshot at http://snaps.php.net/.
 
In case this was a documentation problem, the fix will show up soon at
http://www.php.net/manual/.

In case this was a PHP.net website problem, the change will show
up on the PHP.net site and on the mirror sites in short time.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Thu Apr 17 12:01:59 2014 UTC