Should sessions override user sent headers?

11 years ago by Nikita Nefedov — view source

unread

Hi,

so I stumbled upon this bug report: https://bugs.php.net/bug.php?id=64357

It's fairly easily fixable, but I don't know if it's even a bug... The
problem here: sessions always send Expire header (except for
private_no_expire), so if user (php user) sent Expire header before
session_start() call, it will be replaced (see
https://github.com/php/php-src/blob/master/ext/session/session.c#L1066 and
ADD_HEADER macros for example).

11 years ago by Stas Malyshev — view source

unread

Hi!

so I stumbled upon this bug report: https://bugs.php.net/bug.php?id=64357

It's fairly easily fixable, but I don't know if it's even a bug... The

Well, the result in the bug is obviously wrong - it should have one
date, or another date, but not both! I'd say if you explicitly set the
Expires, it should override the session one. In general, later one
should override previous one.

--
Stanislav Malyshev, Software Architect
SugarCRM: http://www.sugarcrm.com/
(408)454-6900 ext. 227