Repository navigation
Built-in webserver not passing header correctly #16137
Description
Description
E.g. the ´Forwarded` header might appear more then once, NGinx and Apache correctly merge them into a comma separated list.
But the built-in server does not and just passes the first header set.
To test:
<?php
// index.php
var_dump($_SERVER['HTTP_FORWARDED']);Run with:
php -S localhost:8000Test with curl:
curl -v -H 'Forwarded: for=127.0.0.1' -H 'Forwarded: for=unknown' localhost:8000
* Host localhost:8000 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
* Trying [::1]:8000...
* Connected to localhost (::1) port 8000
* using HTTP/1.x
> GET / HTTP/1.1
> Host: localhost:8000
> User-Agent: curl/8.10.1
> Accept: */*
> Forwarded: for=127.0.0.1
> Forwarded: for=unknown
>
* Request completely sent off
< HTTP/1.1 200 OK
< Host: localhost:8000
< Date: Mon, 30 Sep 2024 17:28:59 GMT
< Connection: close
< X-Powered-By: PHP/8.3.11
< Content-type: text/html; charset=UTF-8
<
string(13) "for=127.0.0.1"Expected output:
for=127.0.0.1,for=unknown
PHP Version
8.3.11
Operating System
openSUSE Tumbleweek
Activity
devnexen commentedon Oct 1, 2024
not familiar that much with cli but seems to me the callback to concat value to headers need to handle Forwarded based headers values differently to address it, will start to look at it later today.
Fix GH-16137: "Deduplicate" http headers values but Set-Cookie.