Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96516
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ohgaki.net designates 180.42.98.130 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CANUQDCiJcaX4mbbcgCjZFtCFxzCMSjjLN-h6gtyyX1d_HVdBKw@mail.gmail.com>
References: <CAGa2bXb0CKP6=eZZk2atR5XGtR8JmQ3FG756wn0J7kkPGYFyZg@mail.gmail.com>
 <1eab7492-596c-ffd2-81ed-0eb9256a033e@gmail.com> <CAGa2bXY5u_VgJnoOq06dGj4uS2uVDwCC4qm358tJHEq+gfHVuw@mail.gmail.com>
 <0B722A15-A29F-498B-987F-F6BA5AA49EEF@bobs-bits.com> <CAGa2bXZq6uydypJNGw3n7wJ3VRCS0o3c2L_FABYJZ-B1x4naGg@mail.gmail.com>
 <59D6B40B-DC64-43A3-AED4-CD5C9C15B6BA@koalephant.com> <CAGa2bXbVMvkUsHvsjJ7YVO6pY84rV1RTcG0PzusdK8a+ff9C0g@mail.gmail.com>
 <CANUQDCg6FAiOFpyoaq2EyPjxrLGN+4XzXdf7fX66yVbAR9Q2EA@mail.gmail.com>
 <CAGa2bXZrO2SiqPV6wDb=3+9XGdNHFUSPL5Qoh4yR-_Hq62GyVw@mail.gmail.com> <CANUQDCiJcaX4mbbcgCjZFtCFxzCMSjjLN-h6gtyyX1d_HVdBKw@mail.gmail.com>
Date: Thu, 20 Oct 2016 20:29:33 +0900
Message-ID: <CAGa2bXZJbUeV+9N=XTd9xedxHefBkR78PWxOH1HTan5BZRBfvA@mail.gmail.com>
To: Niklas Keller <me@kelunik.com>
Cc: Stephen Reay <php-lists@koalephant.com>, Stanislav Malyshev <smalyshev@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>, Davey Shafik <davey@php.net>, Xinchen Hui <laruence@php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] header() removes all header of the same name.
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Niklas,

On Thu, Oct 20, 2016 at 7:39 PM, Niklas Keller <me@kelunik.com> wrote:
> 016-10-20 11:57 GMT+02:00 Yasuo Ohgaki <yohgaki@ohgaki.net>:
>>
>> Hi Niklas,
>>
>> On Thu, Oct 20, 2016 at 6:01 PM, Niklas Keller <me@kelunik.com> wrote:
>> >
>> > same here, it's not acceptable to limit header and restrict
>> > `set_cookie`.
>> > Just think about all those frameworks that would have to specialcase
>> > setting
>> > headers now and have to use the cookie API then.
>> >
>> > If you want to protect the session cookie header, why not simply set it
>> > right before the first output? That'd make it also non-overrideable, but
>> > leaves header() intact. But I guess it's harder to implement.
>>
>> Although, I prefer to have completely separate API, we have to
>> implement vote result. So vote no for "Disabling 'Set-Cookie' for
>> header*()" vote option.
>
>
> I don't have a vote. But this breaks BC. It might remove surprisings when
> using sessions, but having header() not being able to set `set-cookie`
> headers adds new surprisings.

That's why we have minor releases and document.

Besides, I noted "add API 7.x, disallow header('Set-Cookie') by 8.0".
There are years to prepare for the change even if we decide to do so.

>
>>
>> Regarding about delaying session cookie header, it is possible to use
>> output buffer to delay output so that session module can send HTTP
>> header at request shutdown. However, it will break almost all session
>> enabled applications that require immediate output. Therefore, it's
>> easy to implement, but not possible for this reason.
>
>
> I meant squeeze in right before output or on first flush() call. There must
> be a thing that sets a "already output" flag that prevents further headers.
> We could use that mechanism to buffer all headers and just send them out
> there and have a hook for the session module.

The reason why I think of this new API proposal is to remove
core(main/SAPI.c) dependency to session. Your idea requires the
dependency (main/SAPI.c) like my the other proposal. Technically, it's
possible and it can be simpler by detecting and preventing session ID
deletion/modification.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net