Setting HTTP response status code in PHP using header('HTTP/1.1 <status-code>')?

Question

I mostly see the response code being set like this:

header('HTTP/1.1 404 Not Found');

But the below also seems to work fine

header('HTTP/1.1 404');

wanted to know if it absolutely necessary to specify the status code description like OK, Not Found etc. I would like to avoid specifying since my status code is a variable and I would need to maintain a table of some sort mapping every single status code to the status code description. Please find the the code I am using below.

$status = 404; //or any other response code
$protocol = (isset($_SERVER['SERVER_PROTOCOL']) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0');
header($protocol." $status");

Appreciate any help.

The reason phrase (the thing after statuscode-and-whitespace) is not optional, but can be empty. — Julian Reschke
– Julian Reschke, Commented Jan 20, 2021 at 13:36
@Syscall that page does have info on various ways to set the status code, However, I have a more specific question and want to understand if there are any pitfalls in implementing it this way (because I haven't come across this form in documentation) — applecodervinegar
– applecodervinegar, Commented Jan 20, 2021 at 14:04
@JulianReschke apologies, but that statement seems contradictory? if you can elaborate that would be great. — applecodervinegar
– applecodervinegar, Commented Jan 20, 2021 at 14:06
even if the reason phrase is empty, you still need a trailing whitespace in the status line; see RFC 7230, Section 3.1.2 — Julian Reschke
– Julian Reschke, Commented Jan 20, 2021 at 16:08

Syscall · Accepted Answer · 2021-01-20 19:05:04Z

2

The message is sent, even if you don't provide it.

In the PHP source code, we can see how it works.

In sapi/litespeed/lsapi_main.c, a list of code/message is stored.

static const http_error http_error_codes[] = {
   {100, "Continue"},
   {101, "Switching Protocols"},
   {200, "OK"},
   // ...
   {403, "Forbidden"},
   {404, "Not Found"},
   // ...
   {0,   NULL}
};

Then, in the sapi_lsapi_send_headers_like_cgi(), from sapi_lsapi_send_headers(), the status is converted to integer and message is found in the http_error structure (many lines ommited below) :

if (SG(sapi_headers).http_response_code != 200)
{
    // ...
    if (SG(sapi_headers).http_status_line &&
         (s = strchr(SG(sapi_headers).http_status_line, ' ')) != 0 &&
         (s - SG(sapi_headers).http_status_line) >= 5 &&
         strncasecmp(SG(sapi_headers).http_status_line, "HTTP/", 5) == 0
    ) {
        len = slprintf(buf, sizeof(buf), "Status:%s", s);
        response_status = atoi((s + 1));
    }
    // ...
            http_error *err = (http_error*)http_error_codes;
            while (err->code != 0) {
                if (err->code == SG(sapi_headers).http_response_code) {
                    break;
                }
                err++;
            }
            if (err->msg) {
                len = slprintf(buf, sizeof(buf), "Status: %d %s", SG(sapi_headers).http_response_code, err->msg);
            } else {
                len = slprintf(buf, sizeof(buf), "Status: %d", SG(sapi_headers).http_response_code);
            }
        //...

Then the function LSAPI_SetRespStatus_r() hold this information and finally, the function LSAPI_FinalizeRespHeaders_r() send the finalized header informations.

The most interesting line is (store the message from the http_error) :

len = slprintf(buf, sizeof(buf), "Status: %d %s", SG(sapi_headers).http_response_code, err->msg);

For information, see also the simple structure of http_error :

typedef struct _http_error {
  int code;
  const char* msg;
} http_error;

edited Jan 20, 2021 at 19:05

answered Jan 20, 2021 at 16:21

Syscall

19.8k10 gold badges44 silver badges60 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

applecodervinegar Over a year ago

Thanks for the details. let me go through the code and understand this better. Would you know if this behaviour is version independent?

Syscall Over a year ago

@applecodervinegar This code was added in the version 7.2.

applecodervinegar Over a year ago

I tested in PHP/7.1.33 and it was working fine without the message

Syscall Over a year ago

Right. Just checked in PHP source code : before 7.2, the function was sapi_cgi_send_headers(). So it works at least as of PHP 5.6 (checked).

Syscall Over a year ago

Also, note that the "Reason-Phrase is intended for the human user. The client is not required to examine or display the Reason-Phrase." (Hypertext Transfer Protocol §6.1.1)

Collectives™ on Stack Overflow

Setting HTTP response status code in PHP using header('HTTP/1.1 <status-code>')?

1 Answer 1

5 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related