php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Request #74535 please warn users when implicit Location: HTTP status override triggers
Submitted: 2017-05-03 13:27 UTC Modified: -
Votes:4
Avg. Score:3.5 ± 0.9
Reproduced:2 of 2 (100.0%)
Same Version:1 (50.0%)
Same OS:0 (0.0%)
From: joy+php at entuzijast dot net Assigned:
Status: Open Package: HTTP related
PHP Version: Irrelevant OS:
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please — but make sure to vote on the bug!
Your email address:
MUST BE VALID
Solve the problem:
44 - 42 = ?
Subscribe to this entry?

 
 [2017-05-03 13:27 UTC] joy+php at entuzijast dot net 
Description:
------------
Hi,

An aspect of this bug was previously reported at https://bugs.php.net/bug.php?id=70273

When you run:

header("HTTP/1.1 202 Accepted");
header("Location: whatever");

...this second header will invoke the function which will replace the user-defined status code (202 in this example) with a 302. This is fine, as it is conformant to RFC 2616, but there should really be a warning emitted in the logs to tell the user that their input was explicitly ignored. For example, say "PHP Warning: Location header incompatible with HTTP/1.1 202 Accepted, falling back to HTTP/1.1 302 Found"

TIA.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2017-05-03 19:09 UTC] remy at lebeausoftware dot org 
Replacing a previously established status code with 302 is NOT conformant to RFC 2616.  Nowhere does that RFC say that the 'Location' header can't be used in status codes other than 201 and 3xx.  It would make sense for header() to *default* the 'Location' header to 302 if a status code has not been assigned yet, but it certainly should not overwrite an existing status code, or at least should only overwrite 200.  The 'Location' header is treated as a redirect only in 201 and 3xx, but it can be used by other status codes for other purposes besides redirects.
 [2017-05-03 19:13 UTC] remy at lebeausoftware dot org 
"The 'Location' header is treated as a redirect only in 201 and 3xx".  Sorry, I meant 3xx only (not including 304, BTW).  In fact, case in point, 201 defines 'Location; for non-redirect purposes (the new URL of the created resource).  So can other status codes as desired.  'Location' can have semantic meaning in 202 (a status monitor URL for the pending operation), for instance.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Fri Apr 19 10:01:28 2024 UTC