Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:96515 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 54113 invoked from network); 20 Oct 2016 11:24:46 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 20 Oct 2016 11:24:46 -0000 Authentication-Results: pb1.pair.com header.from=php-lists@koalephant.com; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=php-lists@koalephant.com; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain koalephant.com designates 206.123.115.54 as permitted sender) X-PHP-List-Original-Sender: php-lists@koalephant.com X-Host-Fingerprint: 206.123.115.54 mail1.25mail.st Received: from [206.123.115.54] ([206.123.115.54:52340] helo=mail1.25mail.st) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id A7/55-24564-A79A8085 for ; Thu, 20 Oct 2016 07:24:44 -0400 Received: from [10.0.1.23] (unknown [183.89.46.225]) by mail1.25mail.st (Postfix) with ESMTPSA id 62A8D6032D; Thu, 20 Oct 2016 11:24:20 +0000 (UTC) Content-Type: multipart/alternative; boundary="Apple-Mail=_00DF004A-5E7B-4C3C-8885-B8D58267E173" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) In-Reply-To: Date: Thu, 20 Oct 2016 18:24:13 +0700 Cc: Yasuo Ohgaki , Stanislav Malyshev , "internals@lists.php.net" , Davey Shafik , Xinchen Hui Message-ID: References: <1eab7492-596c-ffd2-81ed-0eb9256a033e@gmail.com> <0B722A15-A29F-498B-987F-F6BA5AA49EEF@bobs-bits.com> <59D6B40B-DC64-43A3-AED4-CD5C9C15B6BA@koalephant.com> To: Niklas Keller X-Mailer: Apple Mail (2.3124) Subject: Re: [PHP-DEV] header() removes all header of the same name. From: php-lists@koalephant.com (Stephen Reay) --Apple-Mail=_00DF004A-5E7B-4C3C-8885-B8D58267E173 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Niklas, There is even a userland hook for the specific functionality you = mention: header_register_callback().=20 But I would argue that no fix is necessary. If you as a developer call = session_start(), and then later call header(=E2=80=98Set-Cookie:=E2=80=A6=E2= =80=99) with replace left as true, I think it=E2=80=99s safe to assume = you=E2=80=99re either doing it deliberately, or that you=E2=80=99ll go = read the documentation on sessions and header() to discover the problem. = (Or possibly file a bug which will be marked as not-a-bug and refer you = to the documentation). The *only* solution that retains full control for the developer, is no = change. Any =E2=80=9Cmagic=E2=80=9D about =E2=80=9Cuntouchable=E2=80=9D = cookie headers (e.g. forcing the session cookie header after userland = cookie headers) takes away options for the developer. If *anything* the BC break being discussed should be to invert the = default value for the $replace argument to header(). Cheers Stephen=20 > On 20 Oct 2016, at 17:39, Niklas Keller wrote: >=20 > 2016-10-20 11:57 GMT+02:00 Yasuo Ohgaki >: > Hi Niklas, >=20 > On Thu, Oct 20, 2016 at 6:01 PM, Niklas Keller > wrote: > > > > same here, it's not acceptable to limit header and restrict = `set_cookie`. > > Just think about all those frameworks that would have to specialcase = setting > > headers now and have to use the cookie API then. > > > > If you want to protect the session cookie header, why not simply set = it > > right before the first output? That'd make it also non-overrideable, = but > > leaves header() intact. But I guess it's harder to implement. >=20 > Although, I prefer to have completely separate API, we have to > implement vote result. So vote no for "Disabling 'Set-Cookie' for > header*()" vote option. >=20 > I don't have a vote. But this breaks BC. It might remove surprisings = when using sessions, but having header() not being able to set = `set-cookie` headers adds new surprisings. > =20 > Regarding about delaying session cookie header, it is possible to use > output buffer to delay output so that session module can send HTTP > header at request shutdown. However, it will break almost all session > enabled applications that require immediate output. Therefore, it's > easy to implement, but not possible for this reason. >=20 > I meant squeeze in right before output or on first flush() call. There = must be a thing that sets a "already output" flag that prevents further = headers. We could use that mechanism to buffer all headers and just send = them out there and have a hook for the session module. >=20 > Regards, Niklas > =20 > Regards, >=20 > -- > Yasuo Ohgaki > yohgaki@ohgaki.net >=20 > -- > PHP Internals - PHP Runtime Development Mailing List > To unsubscribe, visit: http://www.php.net/unsub.php = --Apple-Mail=_00DF004A-5E7B-4C3C-8885-B8D58267E173--