|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #44744 apache_response_headers() does not include duplicate headers
Submitted: 2008-04-16 16:25 UTC Modified: 2021-07-30 12:19 UTC
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:1 (100.0%)
From: chsc at peytz dot dk Assigned: cmb (profile)
Status: Closed Package: Apache2 related
PHP Version: 5.2.5 OS: Linux
Private report: No CVE-ID: None
 [2008-04-16 16:25 UTC] chsc at peytz dot dk
When multiple response headers with the same name are set using header(..., false), only the last value is returned by apache_response_headers().

apache_response_headers() returns an associative array, so it cannot have multiple entries for the same header name. However, according to section 4.2 of RFC 2616, multiple headers with the same name may be combined into one comma-separated header.

    It MUST be possible to combine the multiple header fields into
    one "field-name: field-value" pair, without changing the semantics
    of the message, by appending each subsequent field-value to the
    first, each separated by a comma.

I suggest that apache_response_headers() does this, i.e. combines multiple headers with comma.

Reproduce code:
header('Foo: 1');
header('Foo: 2', false);
header('Foo: 3', false);

Expected result:
array(2) {
  string(9) "PHP/5.2.5"
  string(1) "1,2,3"

Actual result:
array(2) {
  string(9) "PHP/5.2.5"
  string(1) "3"


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2011-04-08 21:22 UTC]
-Package: Feature/Change Request +Package: Apache2 related
 [2012-09-09 12:13 UTC] space at wechall dot net
Also in PHP 5.3.10…
i will test it on PHP 5.4 ASAP…

Bug #25173 can be closed as duplicate of this…
 [2020-03-08 06:35 UTC]
PHP 7.3 with Apache 2.4 (mod_php) does not exhibit this behavior: Duplicate headers get merged into one ("X: Foo" and "X: Bar" appear in PHP as "X: Foo, Bar").

The problem still occurs with nginx/php-fpm, but that's a different problem.
 [2021-07-30 12:19 UTC]
-Status: Open +Status: Closed -Assigned To: +Assigned To: cmb
 [2021-07-30 12:19 UTC]
Well, then this ticket can be closed.
PHP Copyright © 2001-2022 The PHP Group
All rights reserved.
Last updated: Wed Aug 10 11:05:45 2022 UTC