php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #47687 header("Location:") changing HTTP status in FCGI mode.
Submitted: 2009-03-17 09:54 UTC Modified: 2009-03-31 14:00 UTC
Votes:1
Avg. Score:1.0 ± 0.0
Reproduced:0 of 1 (0.0%)
From: make dot fire at gmail dot com Assigned: pajoye (profile)
Status: Not a bug Package: HTTP related
PHP Version: 5.3CVS-2009-03-17 (snap) OS: windows vista
Private report: No CVE-ID: None
 [2009-03-17 09:54 UTC] make dot fire at gmail dot com
Description:
------------
This bug is identical to bug #25044.

When setting the "Location" HTTP header using the header() function, PHP automatically changes the HTTP response status to "302 Found", Whether other status codes is already set or not.



Reproduce code:
---------------
file1.php:
<?php
header('HTTP/1.1 201 Created');
header("Location: http://www.php.net/");
exit;
?>

file2.php:
<?php
header('HTTP/1.1 303 See Other');
header("Location: http://www.php.net/");
exit;
?>

Expected result:
----------------
HTTP Response:

file1.php:

HTTP/1.1 201 Created
Location: http://www.php.net/


file2.php:

HTTP/1.1 303 See Other
Location: http://www.php.net/


Actual result:
--------------
HTTP Response:

file1.php:

HTTP/1.0 302 Found
Location: http://www.php.net/


file2.php:

HTTP/1.0 302 Found
Location: http://www.php.net/


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-03-17 10:01 UTC] make dot fire at gmail dot com
And, the workaround in #25044 is not working,
the code:

header("Location: http://www.php.net/");
header('HTTP/1.1 303 See Other');

or

header("Location: http://www.php.net/");
header('HTTP/1.1 303 See Other', true, 303);

will result same response header:

HTTP/1.0 302 Found
Location: http://www.php.net/
 [2009-03-17 11:03 UTC] jani@php.net
First of all, both of your examples work fine for me and produce the expected results. You did not mention what web server you are using? And exactly what PHP version are you using?
 [2009-03-17 13:56 UTC] make dot fire at gmail dot com
I try to use the lastest snapshots (PHP 5.3 (5.3.0beta2-dev),VC9 x86 Non Thread Safe (2009-Mar-17 13:00:00)),got the same result.

some infomation from phpinfo():
System: 	Windows NT  6.0 build 6001 (Windows Vista Ultimate Edition Service Pack 1) i586
Build Date: 	Mar 17 2009 12:55:17
Compiler:	MSVC9 (Visual C++ 2008)
Architecture: 	x86 
Server API: 	CGI/FastCGI 

CGI section:
Directive	Local Value	Master Value
cgi.discard_path	0	0
cgi.fix_pathinfo	1	1
cgi.force_redirect	0	0
cgi.nph	0	0
cgi.redirect_status_env	no value	no value
cgi.rfc2616_headers	0	0
fastcgi.impersonate	1	1
fastcgi.logging	1	1

webserver is IIS7, PHP run in FastCGI mode(use php-cgi.exe).

I use HttpWatch to catch response header, 
when use code:

<?php
header('HTTP/1.1 303 See Other');
header("Location: http://www.php.net/");
exit;
?>

the status line in response is:

HTTP/1.1 302 Redirect

and when use code:

<?php
header('HTTP/1.1 303 See Other');
exit;
?>

the status line in response is:

HTTP/1.1 303 See Other
 [2009-03-17 14:13 UTC] make dot fire at gmail dot com
When run php-cgi.exe in command line, the result is expected:

D:\project\www>php-cgi ./test.php
Status: 303 See Other
Location: http://www.php.net/
Content-type: text/html; charset=utf-8


test.php:
<?php
header('HTTP/1.1 303 See Other');
header("Location: http://www.php.net/");
exit;
?>

but visit same file throuth browser and webserver (use http://localhost/test.php) will get 302 status code.
 [2009-03-17 14:24 UTC] make dot fire at gmail dot com
when use this test code:
test.php:
<?php
header("Location: http://www.php.net/");
exit;
?>

use broswer to visit http://localhost/test.php, the status line in response is:

HTTP/1.1 302 Redirect

and use php-cgi.exe under commend line get:

D:\project\www>php-cgi ./test.php
Status: 302 Moved Temporarily
Location: http://www.php.net/
Content-type: text/html; charset=utf-8
 [2009-03-17 14:30 UTC] make dot fire at gmail dot com
If change to ISAPI mode(use php5isapi.dll), the result is expected.

<?php
header('HTTP/1.1 303 See Other');
header("Location: http://www.php.net/");
exit;
?>

will got status line:

HTTP/1.1 303 See Other
 [2009-03-18 02:16 UTC] make dot fire at gmail dot com
I have tried using PHP 5.2 (5.2.10-dev), both VC6 x86 Non Thread Safe (2009-Mar-18 00:00:00) and VC6 x86 Thread Safe (2009-Mar-18 00:00:00). And have tried on windows vista and windows server 2008, got the same results:

test code:

code1:
<?php
header('HTTP/1.1 303 See Other');
header("Location: http://www.php.net/");
exit;
?>

code2:
<?php
header('HTTP/1.1 303 See Other');
exit;
?>

code3:
<?php
header("Location: http://www.php.net/");
exit;
?>

the problem only occurs when run php in fastCGI mode(using php-cgi.exe). 
code1 produce status line:
HTTP/1.1 302 Redirect  (expected: HTTP/1.1 303 See Other)
code2 porduct status line:
HTTP/1.1 303 See Other (expected: HTTP/1.1 303 See Other)
code3 product status line:
HTTP/1.1 302 Redirect  (expected: HTTP/1.1 302 Moved Temporarily)


when run php in ISAPI mode(using php5isapi.dll) or run php-cgi.exe under commend line, both test codes will produce expected result.

it seems that something wrong with header("Location: ") with CGI mode...
 [2009-03-18 14:38 UTC] dmitry@php.net
The issue is probably caused by fastcgi module of web server. The PHP sends proper headers, but it looks like fastcgi module sets status to 302 in case it finds "Location" header.
 [2009-03-23 08:41 UTC] make dot fire at gmail dot com
yep, I think that you're right.
wait for M$ to fix it..
 [2009-03-26 23:11 UTC] pajoye@php.net
Confirmed, it is a bug in the FastCGI. I will notice you as soon as an update is available.
 [2009-03-31 14:00 UTC] jani@php.net
Bugs in MS crap aren't bugs in PHP -> BOGUS.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Apr 19 01:01:28 2024 UTC