php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #77155 Location header no longer coexists with status 201
Submitted: 2018-11-14 19:26 UTC Modified: 2018-11-16 15:49 UTC
From: marnick dot leau at gmail dot com Assigned:
Status: Open Package: CGI/CLI related
PHP Version: 7.2.12 OS: Linux
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2018-11-14 19:26 UTC] marnick dot leau at gmail dot com
Description:
------------
In the selected version and some previous ones going back a few weeks or months (not sure which exact versions), a change was apparently made to the Location header mechanism.

Test script:
---------------
http_response_code(201);
header('HTTP/1.1 201 Created', true, 201);
header('Location: foobar', true, 201);
http_response_code(201);
header('HTTP/1.1 201 Created', true, 201);

Expected result:
----------------
It's supposed to be possible to set the Location header and have a status 3** OR 201. At the very least php's own docs confirm this: https://secure.php.net/manual/en/function.header.php

Actual result:
--------------
Setting the Location header results in a 302 no matter what I try to the contrary.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2018-11-15 13:19 UTC] cmb@php.net
-Status: Open +Status: Feedback -Assigned To: +Assigned To: cmb
 [2018-11-15 13:19 UTC] cmb@php.net
header('Location: http://example.com/', true, 303);

works for me with latest PHP-7.2 and the built-in webserver. Which
SAPI do you use?
 [2018-11-15 16:31 UTC] marnick dot leau at gmail dot com
I use php in lighttpd, is fastcgi the answer you need?

Your example is 303, have you tried 201?

I suppose it could be a lighttpd issue too, but lighttpd's changelog doesn't mention anything like this either, and php has a history of being bossy about Location+status, so I started here...
 [2018-11-15 16:45 UTC] cmb@php.net
-Package: HTTP related +Package: Other web server
 [2018-11-15 16:45 UTC] cmb@php.net
> I use php in lighttpd, is fastcgi the answer you need?

Not quite.  What does php_sapi_name() return (likely either
cgi-fcgi or fpm-fcgi).
 [2018-11-16 15:39 UTC] marnick dot leau at gmail dot com
cgi-fcgi
 [2018-11-16 15:48 UTC] spam2 at rhsoft dot net
honestly that's why phpinfo() shows SAPI and so on to provide basic informations  in the initial report - keep in mind people need to duplicate issues and so in doubt need an as much as possible environment to debug
 [2018-11-16 15:49 UTC] cmb@php.net
-Status: Feedback +Status: Open -Package: Other web server +Package: CGI/CLI related -Assigned To: cmb +Assigned To:
 [2018-11-16 15:49 UTC] cmb@php.net
Thanks!
 [2018-11-16 15:54 UTC] marnick dot leau at gmail dot com
Didn't think of it, sorry. Do you want me to run that now or have you already been able to reproduce it now?
 
PHP Copyright © 2001-2018 The PHP Group
All rights reserved.
Last updated: Tue Dec 11 22:01:26 2018 UTC