php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #43256 wrong behaviour with header()
Submitted: 2007-11-12 00:19 UTC Modified: 2008-10-29 01:00 UTC
Votes:2
Avg. Score:4.0 ± 1.0
Reproduced:2 of 2 (100.0%)
Same Version:2 (100.0%)
Same OS:2 (100.0%)
From: carsten_sttgt at gmx dot de Assigned:
Status: No Feedback Package: IIS related
PHP Version: 5.2.5 OS: Windows_NT
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2007-11-12 00:19 UTC] carsten_sttgt at gmx dot de
Description:
------------
Hallo,

in addition to Bug #42969 I've done some more tests. Tere is really something wrong with header() together with IIS.

The behaviour is different, if I use the CGI or ISAPI.

First I must also say: I have no problem to set this header correct with ASP, Perl or Phyton. Regardless if I use CGI or ISAPI. Of course with CGI, the name of such a script must be prepend with "nph-".

As you can see, the only way to set the correct header/code is:
Having PHP as ISAPI and using header() twice. First with the status and second with the location.

This is totally different to Apache, where I must use only one header() with location and status as parameter (Testscript 2).

Especially with IIS/ISAPI, Testscript 2 should also work. Or remove the status parameter at all: No different behaviour on different platforms.

For IIS/CGI the actual result is acceptable.

For IIS/NPH-CGI: It's not working in no way at the moment!

Regards,
Carsten



Reproduce code:
---------------
Testscript 1 (test.php):
------------------------
<?php
header('HTTP/1.0 303 See Other');
header('Location: http://www.example.com/');
?>

Testscript 2 (test.php):
------------------------
<?php
header('Location: http://www.example.com/', true, 303);
?>

Testscript 3 (nph-test.php):
----------------------------
<?php
echo "HTTP/1.0 303 See Other\r\n";
echo "Location: http://www.example.com/\r\n\r\n";
?>


Expected result:
----------------
D:\PHP>pear-request -r 0 -S http://localhost/test.php
GET http://localhost/test.php --> 303 See Other


Actual result:
--------------
Testscript 1, 2 and 3 with nph-cgi:
| D:\PHP>pear-request -r 0 -S http://localhost/nph-test.php
| GET http://localhost/nph-test.php --> ERROR: Malformed response

Testscript 1 with ISAPI:
| D:\PHP>pear-request -r 0 -S http://localhost/test.php
| GET http://localhost/test.php --> 303 See Other

Testscript 1 with CGI:
| D:\PHP>pear-request -r 0 -S http://localhost/test.php
| GET http://localhost/test.php --> 302 Object Moved

Testscript 2 with ISAPI:
| D:\PHP>pear-request -r 0 -S http://localhost/test.php
| GET http://localhost/test.php --> 303 Undescribed

Testscript 2 with CGI:
| D:\PHP>pear-request -r 0 -S http://localhost/test.php
| GET http://localhost/test.php --> 302 Object Moved


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-11-12 11:23 UTC] jani@php.net
What are you using exactly with IIS? PHP FastCGI binary or ISAPI module? (note: Only former is really useful/working properly)
 [2007-11-12 17:59 UTC] carsten_sttgt at gmx dot de
> What are you using exactly with IIS?
> PHP FastCGI binary or ISAPI module?

As you can see in the examples: both. Or in other words: I can't know, if a script is used with ISAPI or CGI on a customer installation.


> note: Only former is really useful/working properly)

But this is only true for PHP. Why? With other scripting languages, I have no problem to set this header via ISAPI.

And with PHP/ISAPI there is only one problem:
I must use first a header() call to set the status, and then I can use header() with location.
| header('HTTP/1.0 303 See Other');
| header('Location: http://www.example.com/');
(The first header() call is normaly only necessary, if I want change the default reason phrase)

But what ever happens in the PHP core during the first header call, should also done from PHP, if I use the status parameter in header() (like it works with Apache):
| header('Location: http://www.example.com/', true, 303);


Regarding PHP/CGI:
A CGI which want set/use it't own headers (not parsed from the server), must have a script name which starts with "nph-" (that's not only true for IIS, also for other webservers). But if the name from a PHP script is e.g. "nph-test.php", there is no correct output at all.
(as before, with other scripting languages, this works without problems.)

(Or all together: With other scripting languages I use the same documented command(s) to set the header on all webservers in the same way. Only with CGI I must rename the script. With PHP the same command does work different on different webserver and nph-CGI does't work at all.)

Regards,
Carsten
 [2007-11-16 12:46 UTC] jani@php.net
what is this set in your php.ini:
cgi.rfc2616_headers = 0

(look in the phpinfo() output!)

 [2007-11-17 12:03 UTC] carsten_sttgt at gmx dot de
> what is this set in your php.ini: cgi.rfc2616_headers = 0

Now you address the NPH-CGI issue. Correct, my first tests was with "0". Now with "1":
| D:\PHP>pear-request -r 0 -S -o http://localhost/phpinfo.php |\
| grep "cgi.rfc2616_headers"
| cgi.rfc2616_headers11

with Testscript 1:
------------------
| D:\PHP>pear-request -r 0 -S http://localhost/nph-test.php
| GET http://localhost/nph-test.php --> 303 See Other

Works now. (thanks for the hint)

with Testscript 2:
------------------
| D:\PHP>pear-request -r 0 -S http://localhost/nph-test.php
| GET http://localhost/nph-test.php --> ERROR: Malformed response

Don't work.

So we have a similar result as with ISAPI. There is only a correct result, if you also explicitly set the "Status" header. Only setting the "Location" header with the code parameter does not work correctly.

Regards,
Carsten
 [2007-11-17 22:20 UTC] jani@php.net
There's also this setting:

; cgi.nph = 1

Try to turn that off / on.
 [2007-11-19 01:27 UTC] carsten_sttgt at gmx dot de
> There's also this setting:
> ; cgi.nph = 1

There is no difference:
| D:\PHP>cat nph-test.php
| <?php
| header('Location: http://www.example.com/', true, 303);
| ?>
|
| D:\PHP>pear-request -r 0 -S -o http://localhost/phpinfo.php |\
| grep -E "cgi.rfc2616_headers|cgi.nph"
| cgi.nph11
| cgi.rfc2616_headers11
|
| D:\PHP>pear-request -r 0 -S http://localhost/nph-test.php
| GET http://localhost/nph-test.php --> ERROR: Malformed response

BTW:
This setting is only available with CGI, but not with ISAPI.

Regards,
Carsten
 [2007-11-19 14:44 UTC] jani@php.net
Okay, I'm a bit confused now. Where are you reporting the bug? In ISAPI or CGI?
 [2007-11-19 14:57 UTC] carsten_sttgt at gmx dot de
> Where are you reporting the bug? In ISAPI or CGI?

Both. With only using this code:
| header('Location: http://www.example.com/', true, 303);

ISAPI does not set the (default) reason phrase.

CGI (NPH) does not return a complete HTTP response message. The status line is missing.
 [2008-10-21 11:18 UTC] jani@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/


 [2008-10-29 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Tue Dec 07 02:03:34 2021 UTC