Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:56333
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.214.42 as permitted sender)
MIME-Version: 1.0
Sender: patrick.allaert@gmail.com
Date: Tue, 15 Nov 2011 23:09:31 +0100
Message-ID: <CACwt+Jczb7DeptyJ=KT_-2CaCrL0ALhiv5VF_7jpKXuth2CXgQ@mail.gmail.com>
To: PHP Development <internals@lists.php.net>
Cc: mike@php.net
Content-Type: text/plain; charset=UTF-8
Subject: session_regenerate_id() not replacing Set-Cookie header
From: patrickallaert@php.net (Patrick ALLAERT)

Hello,

Calling session_regenerate_id() inside a same request will generate
multiple Set-Cookie headers

example code:
<?
session_start();
session_regenerate_id();
session_regenerate_id();
?>

will result in, e.g.:
Set-Cookie: PHPSESSID=d8afvidkqp9jd4kns8ij976o72; path=/
Set-Cookie: PHPSESSID=lkjla7kvotnfhutb43llcirj61; path=/

As per rfc6265, it seems incorrect:
"Servers SHOULD NOT include more than one Set-Cookie header field in
the same response with the same cookie-name."

And is causing errors on some Blackberry and IE8:
http://anvilstudios.co.za/blog/php/session-cookies-faulty-in-ie8/
http://supportforums.blackberry.com/t5/Web-and-WebWorks-Development/HTTPS-and-php-session-regenerate-id/m-p/125562

It looks like the culprit is in ext/session/session.c:
/* 'replace' must be 0 here, else a previous Set-Cookie
 header, probably sent with setcookie() will be replaced! */
sapi_add_header_ex(ncookie.c, ncookie.len, 0, 0 TSRMLS_CC);
where 'replace' is intentionally set to 0 while everywhere else it is
called with replace = 1 (or via sapi_add_header())

Can someone explain me why we intentionally have that behavior ?

Cheers,
Patrick