php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #77155 Location header no longer coexists with status 201
Submitted: 2018-11-14 19:26 UTC Modified: 2018-11-16 15:49 UTC
From: marnick dot leau at gmail dot com Assigned:
Status: Open Package: CGI/CLI related
PHP Version: 7.2.12 OS: Linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: marnick dot leau at gmail dot com
New email:
PHP Version: OS:

 

 [2018-11-14 19:26 UTC] marnick dot leau at gmail dot com
Description:
------------
In the selected version and some previous ones going back a few weeks or months (not sure which exact versions), a change was apparently made to the Location header mechanism.

Test script:
---------------
http_response_code(201);
header('HTTP/1.1 201 Created', true, 201);
header('Location: foobar', true, 201);
http_response_code(201);
header('HTTP/1.1 201 Created', true, 201);

Expected result:
----------------
It's supposed to be possible to set the Location header and have a status 3** OR 201. At the very least php's own docs confirm this: https://secure.php.net/manual/en/function.header.php

Actual result:
--------------
Setting the Location header results in a 302 no matter what I try to the contrary.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2018-11-15 13:19 UTC] cmb@php.net
-Status: Open +Status: Feedback -Assigned To: +Assigned To: cmb
 [2018-11-15 13:19 UTC] cmb@php.net
header('Location: http://example.com/', true, 303);

works for me with latest PHP-7.2 and the built-in webserver. Which
SAPI do you use?
 [2018-11-15 16:31 UTC] marnick dot leau at gmail dot com
I use php in lighttpd, is fastcgi the answer you need?

Your example is 303, have you tried 201?

I suppose it could be a lighttpd issue too, but lighttpd's changelog doesn't mention anything like this either, and php has a history of being bossy about Location+status, so I started here...
 [2018-11-15 16:45 UTC] cmb@php.net
-Package: HTTP related +Package: Other web server
 [2018-11-15 16:45 UTC] cmb@php.net
> I use php in lighttpd, is fastcgi the answer you need?

Not quite.  What does php_sapi_name() return (likely either
cgi-fcgi or fpm-fcgi).
 [2018-11-16 15:39 UTC] marnick dot leau at gmail dot com
cgi-fcgi
 [2018-11-16 15:48 UTC] spam2 at rhsoft dot net
honestly that's why phpinfo() shows SAPI and so on to provide basic informations  in the initial report - keep in mind people need to duplicate issues and so in doubt need an as much as possible environment to debug
 [2018-11-16 15:49 UTC] cmb@php.net
-Status: Feedback +Status: Open -Package: Other web server +Package: CGI/CLI related -Assigned To: cmb +Assigned To:
 [2018-11-16 15:49 UTC] cmb@php.net
Thanks!
 [2018-11-16 15:54 UTC] marnick dot leau at gmail dot com
Didn't think of it, sorry. Do you want me to run that now or have you already been able to reproduce it now?
 
PHP Copyright © 2001-2020 The PHP Group
All rights reserved.
Last updated: Sat Jan 18 18:01:24 2020 UTC