Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96513
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain kelunik.com from 81.169.146.163 cause and error)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZrO2SiqPV6wDb=3+9XGdNHFUSPL5Qoh4yR-_Hq62GyVw@mail.gmail.com>
References: <CAGa2bXb0CKP6=eZZk2atR5XGtR8JmQ3FG756wn0J7kkPGYFyZg@mail.gmail.com>
 <1eab7492-596c-ffd2-81ed-0eb9256a033e@gmail.com> <CAGa2bXY5u_VgJnoOq06dGj4uS2uVDwCC4qm358tJHEq+gfHVuw@mail.gmail.com>
 <0B722A15-A29F-498B-987F-F6BA5AA49EEF@bobs-bits.com> <CAGa2bXZq6uydypJNGw3n7wJ3VRCS0o3c2L_FABYJZ-B1x4naGg@mail.gmail.com>
 <59D6B40B-DC64-43A3-AED4-CD5C9C15B6BA@koalephant.com> <CAGa2bXbVMvkUsHvsjJ7YVO6pY84rV1RTcG0PzusdK8a+ff9C0g@mail.gmail.com>
 <CANUQDCg6FAiOFpyoaq2EyPjxrLGN+4XzXdf7fX66yVbAR9Q2EA@mail.gmail.com> <CAGa2bXZrO2SiqPV6wDb=3+9XGdNHFUSPL5Qoh4yR-_Hq62GyVw@mail.gmail.com>
Date: Thu, 20 Oct 2016 12:39:02 +0200
Message-ID: <CANUQDCiJcaX4mbbcgCjZFtCFxzCMSjjLN-h6gtyyX1d_HVdBKw@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Stephen Reay <php-lists@koalephant.com>, Stanislav Malyshev <smalyshev@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>, Davey Shafik <davey@php.net>, Xinchen Hui <laruence@php.net>
Content-Type: multipart/alternative; boundary=94eb2c0d7e8abb0f99053f498843
Subject: Re: [PHP-DEV] header() removes all header of the same name.
From: me@kelunik.com (Niklas Keller)

--94eb2c0d7e8abb0f99053f498843
Content-Type: text/plain; charset=UTF-8

2016-10-20 11:57 GMT+02:00 Yasuo Ohgaki <yohgaki@ohgaki.net>:

> Hi Niklas,
>
> On Thu, Oct 20, 2016 at 6:01 PM, Niklas Keller <me@kelunik.com> wrote:
> >
> > same here, it's not acceptable to limit header and restrict `set_cookie`.
> > Just think about all those frameworks that would have to specialcase
> setting
> > headers now and have to use the cookie API then.
> >
> > If you want to protect the session cookie header, why not simply set it
> > right before the first output? That'd make it also non-overrideable, but
> > leaves header() intact. But I guess it's harder to implement.
>
> Although, I prefer to have completely separate API, we have to
> implement vote result. So vote no for "Disabling 'Set-Cookie' for
> header*()" vote option.
>

I don't have a vote. But this breaks BC. It might remove surprisings when
using sessions, but having header() not being able to set `set-cookie`
headers adds new surprisings.


> Regarding about delaying session cookie header, it is possible to use
> output buffer to delay output so that session module can send HTTP
> header at request shutdown. However, it will break almost all session
> enabled applications that require immediate output. Therefore, it's
> easy to implement, but not possible for this reason.


I meant squeeze in right before output or on first flush() call. There must
be a thing that sets a "already output" flag that prevents further headers.
We could use that mechanism to buffer all headers and just send them out
there and have a hook for the session module.

Regards, Niklas


> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--94eb2c0d7e8abb0f99053f498843--