# header_remove() issues (overly aggressive?)

- Thread: https://externals.io/message/44433
- Original archive: https://news-web.php.net/php.internals/44433
- Started by Hannes Magnusson on 2009-06-23T08:55:30+00:00
- Messages: 4
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #44433 — Hannes Magnusson — 2009-06-23T08:55:30+00:00

URL: https://externals.io/message/44433#44433

Hi all

While documenting `header_remove()` I was experimenting a little bit..

If an "empty" argument is passed to the function (empty string, null,
false,..) the function doesn't do anything, as it checks for
ZEND_NUM_ARGS() rather then the length of string.. thats a doc issue
or bug?

Second, it removes even the X-Powered-By header, is that expected?

Third, it removes session and even cookie headers..

bjori@jessica:/usr/src/php/5.3$ sapi/cgi/php-cgi
<?php
 `session_start()`;
 `session_write_close()`;
X-Powered-By: PHP/5.3.0RC5-dev
Set-Cookie: PHPSESSID=b8g31to001mdfoqq6gg1c90ru2; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-type: text/html

bjori@jessica:/usr/src/php/5.3$ sapi/cgi/php-cgi
<?php
 `session_start()`;
 `session_write_close()`;
 `header_remove()`;
Content-type: text/html


Is that really expected? Just add a big fat warning on the doc page?

-Hannes

---

## #44445 — johannes@schlueters.de — 2009-06-23T19:49:06+00:00

URL: https://externals.io/message/44433#44445 · In reply to: #44433

Hi,


> While documenting `header_remove()` I was experimenting a little bit..
> 
> If an "empty" argument is passed to the function (empty string, null,
> false,..) the function doesn't do anything, as it checks for
> ZEND_NUM_ARGS() rather then the length of string.. thats a doc issue
> or bug?

I'd say it's ok, "remove the header with the name ''." That's what it
does.

> Second, it removes even the X-Powered-By header, is that expected?
> 
> Third, it removes session and even cookie headers..

> Is that really expected? Just add a big fat warning on the doc page?

It removes all. Should be ok, too, removing the session cookie might
even be considered a "good" feature by some.

Jut my personal opinion though.

johannes

---

## #44446 — Gwynne Raskind — 2009-06-23T19:57:33+00:00

URL: https://externals.io/message/44433#44446 · In reply to: #44445

> > […]
> I'd say it's ok, "remove the header with the name ''." That's what it
> does.

A header named '' isn't valid in HTTP 1.0 or 1.1 anyway; this is an  
error case IMO.

> > […]

Useful for people who don't have control over their expose_php  
setting...

> > […]
>
> > […]
> It removes all. Should be ok, too, removing the session cookie might
> even be considered a "good" feature by some.

Including me! ;)

-- Gwynne

---

## #44448 — Hannes Magnusson — 2009-06-23T20:22:08+00:00

URL: https://externals.io/message/44433#44448 · In reply to: #44446

2009/6/23 Gwynne Raskind <gwynne@darkrainfall.org>:
> 
> > […]
>
> A header named '' isn't valid in HTTP 1.0 or 1.1 anyway; this is an error
> case IMO.

Also, shouldn't we return false/true when we [can't] remove the named
header? Or a int, with the number of removed items?

> > […]
>
> Useful for people who don't have control over their expose_php setting...
>
> > […]
>
> Including me! ;)

Documented as a 'caution'.

-Hannes