Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71130
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.48 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
Date: Wed, 15 Jan 2014 09:53:52 +0900
Message-ID: <CAGa2bXa8+X_RRoN-ofRqKpePea9FU3Be_hFiy+V5QPY7Eo_FGw@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c2260287d65404eff7c011
Subject: CGI SAPI is sending multiple set-cookie headers when session strict
 mode is on
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c2260287d65404eff7c011
Content-Type: text/plain; charset=UTF-8

Hi all,

CGI SAPI is sending multiple set-ccokie headers when strict mode is on.

[yohgaki@dev test-php-script]$ php-cgi session-strict-mode.php
X-Powered-By: PHP/5.5.7
Set-Cookie: PHPSESSID=semtekrsf2l13svihttdgo4hg4; path=/
Set-Cookie: PHPSESSID=vkh55u82icdq80p3i4v3831kc2; path=/

while CLI server and Apache SAPI does not.

Current php_session_initialize() is

    php_session_reset_id(TSRMLS_C);
    PS(session_status) = php_session_active;

    /* Read data */
    php_session_track_init(TSRMLS_C);
    if (PS(mod)->s_read(&PS(mod_data), PS(id), &val, &vallen TSRMLS_CC) ==
FAILURE) {
        /* Some broken save handler implementation returns FAILURE for
non-existent session ID */
        /* It's better to rase error for this, but disabled error for
better compatibility */
        /*
       php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Failed to read session
data: %s (path: %s)", PS(mod)->s_name, PS(save_path));
        */
    }

I've coded above since I cannot change 3rd party session save handler's
code.
It is better to write as follows (and change PS(session_status) in session
read).

    /* Read data */
    php_session_track_init(TSRMLS_C);
    if (PS(mod)->s_read(&PS(mod_data), PS(id), &val, &vallen TSRMLS_CC) ==
FAILURE) {
        /* Some broken save handler implementation returns FAILURE for
non-existent session ID */
        /* It's better to rase error for this, but disabled error for
better compatibility */
        /*
        php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Failed to read session
data: %s (path: %s)", PS(mod)->s_name, PS(save_path));
        */
    }
    /* Set session ID if session read didn't activated session */
    if (PS(session_status) != php_session_active) {
        php_session_reset_id(TSRMLS_C);
        PS(session_status) = php_session_active;
    }

Session module code could be changed so that it will not try to set
multiple set-cookie headers and works with unmodified 3rd party save
handlers.

Alternatively, I suppose CGI SAPI could be changed, since CLI server and
Apache SAPI does not send multiple set-cookie headers.

There are many SAPIs, so I'm wondering which is the best way to fix this
issue.
Comments are appreciated. Thank you.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c2260287d65404eff7c011--