Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Warn on http_response_code() after header('HTTP/...') #18962

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
iluuu1994 wants to merge 1 commit into php:master
base: master
Choose a base branch
Loading
from iluuu1994:gh-18582

Conversation

Copy link
Member

@iluuu1994 iluuu1994 commented Jun 27, 2025

Fixes GH-18582
Fixes #81451

Copy link
Member Author

@bukka Ping. 🙂

Copy link
Member

bukka commented Jul 21, 2025

This is a BC break so you will need RFC for this.

Copy link
Member

bukka commented Jul 21, 2025

I think it would be good to sync this behaviour but there is some risk as it's been there for long - if I understand correctly, this is also the case for FPM - just Apache does not do that.

Copy link
Member

bukka commented Jul 21, 2025

Basically the implementation can currently rely on the fact that header has got the priority and this might suddenly change the behaviour. You could argue that this is a fix but in this case it's not like the things do not work. It's more about the priority.

Copy link
Member Author

IMO, this doesn't seem intentional, and nothing in the documentation 1 indicates http_response_code() wouldn't work after using header(). I understand this can have BC breaks, which is why I targeted master instead of PHP-8.3. I can shoot a quick e-mail to internals@ if you like.

Footnotes

  1. https://www.php.net/manual/en/function.http-response-code.php

Copy link
Member

bukka commented Jul 21, 2025
edited
Loading

Yeah this for sure not intentional but it doesn't mean that some code does not rely on it. It might be even relying on it accidentally and it will be extremely hard to figure out why the behavior suddenly changed.

If it was just CLI server, then I would mind changing it but if it's in FPM as well, then it might impact production code so in such case I'm against this silent change. I would much prefer warning approach in such case.

Copy link
Member Author

Would you object to this even if internals does not? I'm not particularly keen on a multi-year endeavor to fix this. In that case, I'd leave this up to somebody else.

Copy link
Member

bukka commented Jul 22, 2025

Yeah I don't think this is the right way to fix it. I'd prefer going the warning path as I mentioned in the actual issue.

@iluuu1994 iluuu1994 changed the title (削除) Allow http_response_code() to clear HTTP start-line (削除ここまで) (追記) Warn on http_response_code() after header('HTTP/...') (追記ここまで) Jul 22, 2025
Copy link
Member Author

Ok. Adjusted.

Copy link
Member Author

Does this look ok then?

Fixes phpGH-18582
Fixes #81451
Co-authored-by: Jakub Zelenka <bukka@php.net>
Copy link
Member

bukka commented Sep 3, 2025

@php/release-managers-85 are you cool with this?

Copy link
Member

@DanielEScherzer DanielEScherzer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

RM approval, no technical review performed

edorian reacted with thumbs up emoji
Copy link
Member

krakjoe commented Sep 7, 2025
edited
Loading

The wording might be slightly misleading, the gateway specification being used in most SAPI implementations is CGI, in CGI you can send Status: rather than HTTP. It's probably better to choose wording that covers both cases.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bukka bukka bukka requested changes

@DanielEScherzer DanielEScherzer DanielEScherzer approved these changes

Assignees
No one assigned
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

http_response_code() does not override the status code generated by header()

AltStyle によって変換されたページ (->オリジナル) /