Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96521
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain kelunik.com from 81.169.146.219 cause and error)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXY6be8n86dQ-jW-BZuPCD2iWFhP+_0HGHfimEe4E517Dw@mail.gmail.com>
References: <CAGa2bXb0CKP6=eZZk2atR5XGtR8JmQ3FG756wn0J7kkPGYFyZg@mail.gmail.com>
 <1eab7492-596c-ffd2-81ed-0eb9256a033e@gmail.com> <CAGa2bXY5u_VgJnoOq06dGj4uS2uVDwCC4qm358tJHEq+gfHVuw@mail.gmail.com>
 <0B722A15-A29F-498B-987F-F6BA5AA49EEF@bobs-bits.com> <CAGa2bXZq6uydypJNGw3n7wJ3VRCS0o3c2L_FABYJZ-B1x4naGg@mail.gmail.com>
 <59D6B40B-DC64-43A3-AED4-CD5C9C15B6BA@koalephant.com> <CAGa2bXbVMvkUsHvsjJ7YVO6pY84rV1RTcG0PzusdK8a+ff9C0g@mail.gmail.com>
 <CANUQDCg6FAiOFpyoaq2EyPjxrLGN+4XzXdf7fX66yVbAR9Q2EA@mail.gmail.com>
 <CAGa2bXZrO2SiqPV6wDb=3+9XGdNHFUSPL5Qoh4yR-_Hq62GyVw@mail.gmail.com>
 <CANUQDCiJcaX4mbbcgCjZFtCFxzCMSjjLN-h6gtyyX1d_HVdBKw@mail.gmail.com>
 <A9816C1C-70F4-49E0-93D8-FE370FFF796E@koalephant.com> <CAGa2bXY6be8n86dQ-jW-BZuPCD2iWFhP+_0HGHfimEe4E517Dw@mail.gmail.com>
Date: Thu, 20 Oct 2016 14:21:01 +0200
Message-ID: <CANUQDCiR=nCEtf9=BBHK4vvFzWAHz9by1G7ZGLd9TvC70XDPCQ@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Stephen Reay <php-lists@koalephant.com>, Stanislav Malyshev <smalyshev@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>, Davey Shafik <davey@php.net>, Xinchen Hui <laruence@php.net>
Content-Type: multipart/alternative; boundary=089e01227ab080a16f053f4af56d
Subject: Re: [PHP-DEV] header() removes all header of the same name.
From: me@kelunik.com (Niklas Keller)

--089e01227ab080a16f053f4af56d
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

2016-10-20 13:41 GMT+02:00 Yasuo Ohgaki <yohgaki@ohgaki.net>:

> Hi Stephen,
>
> On Thu, Oct 20, 2016 at 8:24 PM, Stephen Reay <php-lists@koalephant.com>
> wrote:
> > The *only* solution that retains full control for the developer, is no
> > change. Any =E2=80=9Cmagic=E2=80=9D about =E2=80=9Cuntouchable=E2=80=9D=
 cookie headers (e.g. forcing the
> > session cookie header after userland cookie headers) takes away options
> for
> > the developer.
>
> My cookie*() functions proposal allows developers to remove header by
> cookie_remove() and can send any cookie header by cookie_custom().
> Therefore, developers have full control if they have to.
>
> The only pain is that users may have to use cookie*() functions if we
> disallow header('Set-Cookie') which will be a vote option. If there is
> fully functional cookie*() functions, it will mitigate wrong
> header('Set-Cookie') usage regardless of the vote result, hopefully.
>

What about extensions to the `set-cookie` header? Take `SameSite` as a
recent example. The `setcookie` API doesn't cover that. Besides that, the
current `setcookie` API is awful, people just added more and more
parameters.

Before we even discuss disallowing `header("set-cookie")`, we should have a
sane cookie API, e.g. one that like `setcookie($name, $value, $flags)`.

That's also the way we implemented it in Aerys (
https://github.com/amphp/aerys/blob/9a7327f062aa678408dfe4f4c3c7f479db16f18=
7/lib/Response.php#L49-L58).
It's a simple wrapper around `addHeader` to make life easier, but it
doesn't restrict developers to call `setHeader` and replace all
`set-cookie` headers.

Regards, Niklas

--089e01227ab080a16f053f4af56d--