Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:22664
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Message-ID: <4432D542.1000700@smashlabs.com>
Date: Tue, 04 Apr 2006 15:21:22 -0500
User-Agent: Thunderbird 1.5 (Windows/20051201)
MIME-Version: 1.0
To: internals@lists.php.net
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: session_start and set-cookie woes
From: ralph@smashlabs.com (Ralph Schindler)

Is there any reason why session_start should be sending a new
Set-Cookie: name=id on each and every session_start call?  It seems to
me the original functionality of this function would only send a
set-cookie if a valid session didn't already existed and/or was not 
provided by the client.

These are the changes I believe broke the original functionality of
sending a set-cookie header only when needed:

http://cvs.php.net/viewcvs.cgi/php-src/ext/session/session.c?r1=1.353&r2=1.354

take a look at

line 1184 on the left
if (PS(send_cookie)) {
      php_session_send_cookie(TSRMLS_C);
}

turned into

php_session_reset_id(TSRMLS_C);

php_session_reset_id() auto calls the send cookie routine.

should this be default behavior?


To demonstrate the issue I have made a sample script called simpletest.php
--------------------------------------------------
<?
session_start();
?>





Here are the request and response headers from 2 calls to the simpletest 
script.
--------------------------------------------------
http://10.20.1.2/tests/sessions/simpletest.php

GET /tests/sessions/simpletest.php HTTP/1.1
Host: 10.20.1.2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) 
Gecko/20060111 Firefox/1.5.0.1
Accept: 
text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://10.20.1.2/tests/sessions/
Cache-Control: max-age=0

HTTP/1.x 200 OK
Date: Tue, 04 Apr 2006 18:58:15 GMT
Server: Apache
X-Powered-By: PHP/5.1.1-gentoo
Set-Cookie: PHPSESSID=679449c50fd155c96311bfac50bcec5a; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, 
pre-check=0
Pragma: no-cache
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=ISO-8859-1
----------------------------------------------------------
http://10.20.1.2/tests/sessions/simpletest.php

GET /tests/sessions/simpletest.php HTTP/1.1
Host: 10.20.1.2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) 
Gecko/20060111 Firefox/1.5.0.1
Accept: 
text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://10.20.1.2/tests/sessions/
Cookie: PHPSESSID=679449c50fd155c96311bfac50bcec5a
Cache-Control: max-age=0

HTTP/1.x 200 OK
Date: Tue, 04 Apr 2006 18:58:19 GMT
Server: Apache
X-Powered-By: PHP/5.1.1-gentoo
Set-Cookie: PHPSESSID=679449c50fd155c96311bfac50bcec5a; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, 
pre-check=0
Pragma: no-cache
Content-Length: 0
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=ISO-8859-1
----------------------------------------------------------