php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #77780 "Headers already sent..." when previous connection was aborted
Submitted: 2019-03-22 10:09 UTC Modified: -
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: mp at webfactory dot de Assigned:
Status: Open Package: Session related
PHP Version: 7.2.16 OS: Ubuntu 18.04.2 LTS
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2019-03-22 10:09 UTC] mp at webfactory dot de
Description:
------------
I am running Apache and forwarding PHP requests to PHP-FPM. 

In the Apache error logfile as well as in the PHP-FPM log, there are spurious messages as follows:

AH01071: Got error 'PHP message: PHP Warning:  Unknown: Headers already sent. You cannot change the session module's ini settings at this time in Unknown on line 0\nPHP message: PHP Warning:  Unknown: Headers already sent. You cannot change the session module's ini settings at this time in Unknown on line 0\n'

I found out that this happens when a PHP-FPM process serves a request and the connection is aborted by the client. Then the *next* request served by this PHP-FPM process will get the above error message. 

Probably relevant information:

- I am forwarding per-vhost configuration settings to PHP-FPM. In Apache, this can be done as follows:

ProxyFCGISetEnvIf "true" PHP_VALUE "session.save_path=\"/some/path/per/vhost\" \n session.cookie_secure=\"1\" \n"

- ignore_user_abort is set to "Off", the default setting.

My guess is that there is some per-connection flag that tracks whether the headers have already been sent, and that this flag is not correctly reset when the script is aborted by a connection reset. Not sure if this is related to PHP-FPM, the SAPI or even a more general problem. 

Exact PHP version is PHP 7.2.15-0ubuntu0.18.04.1, the one currently provided by Ubuntu 18.04.2 LTS.

Test script:
---------------
1. Set up an Apache vhost to use PHP-FPM. Include the following configuration setting to apply PHP settings per vhost, i. e. settings that PHP-FPM has to apply for every single request handled.

ProxyFCGISetEnvIf "true" PHP_VALUE "session.save_path=\"/some/path/per/vhost\" \n session.cookie_secure=\"1\" \n"

2. To make sure all requests hit the same PHP-FPM worker process, configure PHP-FPM with pm=static and pm.max_children=1.

3. Make the following scripts available on the webserver:

<?php # slow.php

print str_repeat('asdfghjkl', 150000);
print "\n";
print "done";

---

<?php # noop.php 
// empty script

---

4. Run the following script to request slow.php, abort the connection, and run noop.php afterwards:

<?php

$fp = fopen('http://url/to/slow.php', 'r');
fread($fp, 1024);
fclose($fp);
file_get_contents('http://url/to/noop.php');

---

5. Observe that the content-length logged by Apache for the slow.php requests is below the 1.3MB actually emitted by the script, but (for me) always larger than the 1024 bytes read by test.php. In practice, values fluctuacte around 100KB.

6. The error message "PHP message: PHP Warning:  Unknown: Headers already sent. You cannot change the session module's ini settings at this time in Unknown on line 0" shows up in server and/or PHP-FPM logfiles.

7. Re-configure PHP-FPM to have ignore_user_abort = On. 

8. Repeat steps 4-5. The error message from 6. does not appear this time.


Expected result:
----------------
No error message should occur and the session configuration should be applied in either case.


Patches

Add a Patch

Pull Requests

Add a Pull Request

 
PHP Copyright © 2001-2019 The PHP Group
All rights reserved.
Last updated: Thu Nov 14 06:01:35 2019 UTC