PHP cookie handling

Question

A centain web client that I need to support, is sending back the Cookies header to my application twice in the HTTP headers, this in turn is making PHP unable to read the correct value for the cookie thus ignoring the session.

Here is the relevant part of the request I am seeing:

GET / HTTP/1.1
Cache-Control: max-age=0
Accept-Language: en-US
Cookie: PHPSESSID=49af82ddf12740e6a35b15985e93d91a
Connection: Keep-Alive
Cookie: PHPSESSID=49af82ddf12740e6a35b15985e93d91a
[...] Other irrelevant headers

I have two questions:

Is that a PHP bug? or is the behavior undefined when the client sends that same header twice?

Is there a quick workaround to make things work without having to manually parse the HTTP headers so I can read the right value of the cookie (and session) in my application? Or should I manually parse the HTTP header to set the session to its correct value?

What server software are you using?

Pekka
– Pekka

2011-12-29 12:14:42 +00:00
Commented Dec 29, 2011 at 12:14 — Pekka
– Pekka, Commented Dec 29, 2011 at 12:14

Tom van der Woerdt · Accepted Answer · 2011-12-29 12:13:31Z

1

According to the HTTP spec, a double header simply concatenates the values together with a comma, making it:

Cookie: PHPSESSID=49af82ddf12740e6a35b15985e93d91a, PHPSESSID=49af82ddf12740e6a35b15985e93d91a

PHP should be able to parse the cookies, but the behavior of sessions is undefined when there are two session IDs.

I strongly recommend fixing the client. If that's not an option, you'll have to parse the headers manually.

answered Dec 29, 2011 at 12:13

Tom van der Woerdt

30k7 gold badges76 silver badges105 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Pat Over a year ago

Thanks, I'll try to see if the client can be quickly fixed

Pat Over a year ago

I was unable to find the reference in the spec that describes this behavior, can you link me up?

Tom van der Woerdt Over a year ago

Multiple message-header fields with the same field-name MAY be present in a message if and only if the entire field-value for that header field is defined as a comma-separated list [i.e., #(values)]. It MUST be possible to combine the multiple header fields into one "field-name: field-value" pair, without changing the semantics of the message, by appending each subsequent field-value to the first, each separated by a comma. Section 4.2

Pat Over a year ago

Thanks @Tom the client's vendor has since acknowledged the problem is from their side and is working on a patch.

Collectives™ on Stack Overflow

PHP cookie handling

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related