php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #30232 Set-Cookie HTTP-Header is missing using session_start()
Submitted: 2004-09-25 22:36 UTC Modified: 2004-12-07 18:04 UTC
Votes:3
Avg. Score:5.0 ± 0.0
Reproduced:2 of 2 (100.0%)
Same Version:2 (100.0%)
Same OS:1 (50.0%)
From: matthias dot heller at gmx dot net Assigned:
Status: Not a bug Package: Session related
PHP Version: 4.3.9 OS: Debian Linux 3.1
Private report: No CVE-ID: None
 [2004-09-25 22:36 UTC] matthias dot heller at gmx dot net
Description:
------------
This bug occures in php-4.3.9 final release
my configure command:
'./configure' '--with-mysql' '--with-apxs2=/usr/bin/apxs2' '--enable-bcmath' '--enable-calendar' '--with-zlib' '--enable-sockets'

The only change in php.ini:

session.cookie_name = PHPSESSID
changed to
session.cookie_name = GWARS_COOKIE

The HTTP-Header Set-Cookie is only send when no session-cookie was send in the HTTP_REQUEST to the server (Apache 2.0.51).
So when I delete my cookies and I call the script for the first time I got in my HTTP headers the following line:

Set-Cookie: GWARS_COOKIE=<SESSION_ID>; expires=<DATE>; path=/

when I call the same page again the Set-Cookie line in the HTTP headers is missing.

The Set-Cookie line in the HTTP headers will occure after I delete my cookies. So the problem is, that my session will be invalid after 30 minutes even if session_start is called again, as I don't get a new Set-Cookie line with the new expiry-date

My browser accept cookies and the script worked fine with php version 4.3.8 same configure command and same php settings.

Hopefully you understand my problem. If not please contact me.

Reproduce code:
---------------
<?php
session_start();
?>

My work around is

<?php
session_start();
if (isset($_COOKIE['GWARS_COOKIE']))
{
    setcookie('GWARS_COOKIE' , $_COOKIE['GWARS_COOKIE'] , time() + 1800);
}//endif
?>

Expected result:
----------------
The code should return an empty page. That works quite fine.
But the HTTP Headers are only correct the first time I call the script. When I call the script more often and my session-cookie is valid the response HTTP headers are incorrect (Set-Cookie ... is missing)

Actual result:
--------------
First time call of script:

HTTP-Return

    HTTP/1.1 200 OK\r\n
    Date: Sat, 25 Sep 2004 20:16:19 GMT\r\n
    Server: Apache/2.0.51 (Debian GNU/Linux) mod_perl/1.99_12 Perl/v5.8.3 PHP/4.3.9\r\n
    X-Powered-By: PHP/4.3.9\r\n
    Set-Cookie: GWARS_COOKIE=f94b066ef5acdeefb4bcce83292c661b; expires=Sat, 25-Sep-2004 20:46:19 GMT; path=/\r\n
    Expires: Thu, 19 Nov 1981 08:52:00 GMT\r\n
    Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\n
    Pragma: no-cache\r\n
    Content-Length: 4\r\n
    Keep-Alive: timeout=2, max=100\r\n
    Connection: Keep-Alive\r\n
    Content-Type: text/html; charset=ISO-8859-1\r\n
    \r\n

second call of script (cache emptied)

    HTTP/1.1 200 OK\r\n
    Date: Sat, 25 Sep 2004 20:16:19 GMT\r\n
    Server: Apache/2.0.51 (Debian GNU/Linux) mod_perl/1.99_12 Perl/v5.8.3 PHP/4.3.9\r\n
    X-Powered-By: PHP/4.3.9\r\n
    Expires: Thu, 19 Nov 1981 08:52:00 GMT\r\n
    Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\n
    Pragma: no-cache\r\n
    Content-Length: 4\r\n
    Keep-Alive: timeout=2, max=100\r\n
    Connection: Keep-Alive\r\n
    Content-Type: text/html; charset=ISO-8859-1\r\n
    \r\n


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-09-25 22:38 UTC] matthias dot heller at gmx dot net
Sorry the other change to php.ini compared to php.ini-dist
is

session.cookie_lifetime = 0

changed to 

session.cookie_lifetime = 1800
 [2004-09-28 23:00 UTC] sniper@php.net
What browser is it? Does it happen with any other browser as well?
 [2004-09-29 23:27 UTC] matthias dot heller at gmx dot net
it happens with all browsers
 [2004-12-07 09:22 UTC] tony2001@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 [2004-12-07 18:04 UTC] sniper@php.net
This wasn't fixed as the curren behaviour is intentional and correct. Please see the short discussion on php-cvs list:


http://marc.theaimsgroup.com/?l=php-cvs&m=110242214531457&w=2

 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri May 17 00:01:34 2024 UTC