Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:116724
MIME-Version: 1.0
References: <5d2b1d8f-9b7a-558f-8750-cc97b3ad0589@gmx.de>
In-Reply-To: <5d2b1d8f-9b7a-558f-8750-cc97b3ad0589@gmx.de>
Date: Thu, 23 Dec 2021 00:06:22 +0000
Message-ID: <CA+p1FaaAb4Oa2tX8tgnnSERobwBa0MTU42QoJ4v6x-i3JB2yyA@mail.gmail.com>
To: "Christoph M. Becker" <cmbecker69@gmx.de>
Cc: PHP internals <internals@lists.php.net>, Jakub Zelenka <bukka@php.net>
Content-Type: multipart/alternative; boundary="000000000000d55b5705d3c502c2"
Subject: Re: [PHP-DEV] header() allows arbitrary status codes
From: davidgebler@gmail.com (David Gebler)

--000000000000d55b5705d3c502c2
Content-Type: text/plain; charset="UTF-8"

On Tue, Dec 21, 2021 at 6:59 PM Christoph M. Becker <cmbecker69@gmx.de>
wrote:

> Hi all,
>
> a while ago it has been reported[1] that our header() function actually
> allows arbitrary status codes, which may even overflow.  Of course, that
> makes no sense, since the status code is supposed to be a three digit
> code.  So this ticket has been followed up by a pull request[2], and
> Jakub suggested to further restrict the status code to be in range 100 -
> 599.
>

Personally, I don't like restricting the status code to a number in the
100-599 range. As far as I know, RFC 7230 doesn't mandate anything beyond
the requirement of 3 digits and while 7231 may only specify semantics for
1xx-5xx, that doesn't mean there isn't a legitimate use-case in custom or
internal applications for status codes outside the usual semantics.

The overflow part is a legit bug which can and should be fixed, but I'd at
least question whether a user should be obliged to stick to conventional
HTTP semantics via the header() function, or even a strictly conformant
implementation of the standards defined 7320. Maybe this behaviour could be
default but overridable via a new, fourth optional parameter or something,
I don't know...but I can easily imagine someone having a legitimate context
in which they want to send status codes outside the usual range
representing custom semantics.


>
> Since this could break some pathological cases, I wanted to ask whether
> anybody objects to this change for the master branch (i.e. PHP 8.2).
>
> [1] <https://bugs.php.net/bug.php?id=81645>
> [2] <https://github.com/php/php-src/pull/7676>
>
> Christoph
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: https://www.php.net/unsub.php
>
>

--000000000000d55b5705d3c502c2--