|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #77780 "Headers already sent..." when previous connection was aborted
Submitted: 2019-03-22 10:09 UTC Modified: -
Avg. Score:3.2 ± 0.9
Reproduced:5 of 5 (100.0%)
Same Version:2 (40.0%)
Same OS:2 (40.0%)
From: mp at webfactory dot de Assigned:
Status: Open Package: Session related
PHP Version: 7.2.16 OS: Ubuntu 18.04.2 LTS
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: mp at webfactory dot de
New email:
PHP Version: OS:


 [2019-03-22 10:09 UTC] mp at webfactory dot de
I am running Apache and forwarding PHP requests to PHP-FPM. 

In the Apache error logfile as well as in the PHP-FPM log, there are spurious messages as follows:

AH01071: Got error 'PHP message: PHP Warning:  Unknown: Headers already sent. You cannot change the session module's ini settings at this time in Unknown on line 0\nPHP message: PHP Warning:  Unknown: Headers already sent. You cannot change the session module's ini settings at this time in Unknown on line 0\n'

I found out that this happens when a PHP-FPM process serves a request and the connection is aborted by the client. Then the *next* request served by this PHP-FPM process will get the above error message. 

Probably relevant information:

- I am forwarding per-vhost configuration settings to PHP-FPM. In Apache, this can be done as follows:

ProxyFCGISetEnvIf "true" PHP_VALUE "session.save_path=\"/some/path/per/vhost\" \n session.cookie_secure=\"1\" \n"

- ignore_user_abort is set to "Off", the default setting.

My guess is that there is some per-connection flag that tracks whether the headers have already been sent, and that this flag is not correctly reset when the script is aborted by a connection reset. Not sure if this is related to PHP-FPM, the SAPI or even a more general problem. 

Exact PHP version is PHP 7.2.15-0ubuntu0.18.04.1, the one currently provided by Ubuntu 18.04.2 LTS.

Test script:
1. Set up an Apache vhost to use PHP-FPM. Include the following configuration setting to apply PHP settings per vhost, i. e. settings that PHP-FPM has to apply for every single request handled.

ProxyFCGISetEnvIf "true" PHP_VALUE "session.save_path=\"/some/path/per/vhost\" \n session.cookie_secure=\"1\" \n"

2. To make sure all requests hit the same PHP-FPM worker process, configure PHP-FPM with pm=static and pm.max_children=1.

3. Make the following scripts available on the webserver:

<?php # slow.php

print str_repeat('asdfghjkl', 150000);
print "\n";
print "done";


<?php # noop.php 
// empty script


4. Run the following script to request slow.php, abort the connection, and run noop.php afterwards:


$fp = fopen('http://url/to/slow.php', 'r');
fread($fp, 1024);


5. Observe that the content-length logged by Apache for the slow.php requests is below the 1.3MB actually emitted by the script, but (for me) always larger than the 1024 bytes read by test.php. In practice, values fluctuacte around 100KB.

6. The error message "PHP message: PHP Warning:  Unknown: Headers already sent. You cannot change the session module's ini settings at this time in Unknown on line 0" shows up in server and/or PHP-FPM logfiles.

7. Re-configure PHP-FPM to have ignore_user_abort = On. 

8. Repeat steps 4-5. The error message from 6. does not appear this time.

Expected result:
No error message should occur and the session configuration should be applied in either case.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2021-03-08 12:10 UTC] kojinob at b-architects dot com

We've encountered the same issue.

What we've confirmed so far were,

- "ignore_user_abort" = On / Off doesn't matter
- If the text (e.g. HTML) has "#include" statement and the text was big enough, the warning message appears.
- Even if the text (e.g. HTML) has "#include" statement, if the text was small, the warning message does not appear.
- If the text was small and not having "#include" statement, the warning message does not appear.

PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Fri Jul 30 11:01:23 2021 UTC