|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #61679 Error on non-standard HTTP methods
Submitted: 2012-04-09 13:47 UTC Modified: 2012-09-18 20:22 UTC
Avg. Score:3.0 ± 1.0
Reproduced:3 of 3 (100.0%)
Same Version:1 (33.3%)
Same OS:1 (33.3%)
From: Assigned: laruence
Status: Closed Package: Built-in web server
PHP Version: 5.4.0 OS: Linux
Private report: No CVE-ID:
 [2012-04-09 13:47 UTC]
The built in webserver bails out with an error on retrieval of a non-standard HTTP request method (e.g. PATCH).

Test script:
Run the PHP built in web server on PORT 8042 and use the following script to reproduce the error:

$httpFilePointer = fopen(                                                       
            'http' => array(                                                    
                'method'        => 'PATCH',                                     

Expected result:
A valid HTTP response, depending on the script run by the server.

Actual result:
The server logs to shell:

[Mon Apr  9 15:45:35 2012] ::1:37726 Invalid request (Malformed HTTP request)

The client complains about a malformed response:

Warning: fopen(http://localhost:8042): failed to open stream: HTTP request failed!  in …


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2012-04-09 13:58 UTC]
hmm, I will try to fix it when I find what will apache does in such case :)
 [2012-04-09 13:58 UTC]
-Assigned To: +Assigned To: laruence
 [2012-04-09 13:58 UTC]
-Status: Assigned +Status: Open
 [2012-04-09 13:58 UTC]
Just to make this clear: HTTP allows arbitrary method verbs to be used. Quoting the EBNF from RFC 2616, chapter 5.1.1:

Method         = "OPTIONS"                ; Section 9.2                         
               | "GET"                    ; Section 9.3                         
               | extension-method                                               
extension-method = token

Event if the server itself does not support a certain method, it should not crash, but send a 405 (Method Not Allowed) response. However, for the built in web server, it makes sense to let the executed script handle this and pipe arbitrary method verbs to it.
 [2012-04-10 04:39 UTC]
-Status: Open +Status: Assigned
 [2012-09-18 20:22 UTC]
-Status: Assigned +Status: To be documented
 [2012-09-18 20:22 UTC]
The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
Thank you for the report, and for helping us make PHP better.

GitHub PR #190 ( merged into 5.4 and 
PHP Copyright © 2001-2015 The PHP Group
All rights reserved.
Last updated: Wed Nov 25 23:01:33 2015 UTC