Response header sent as 302 despite being set to 301

Bug #39984

Submitted:

2006-12-29 14:37 UTC

Modified:

2007-02-23 14:06 UTC

Votes:	25
Avg. Score:	2.8 ± 1.8
Reproduced:	10 of 12 (83.3%)
Same Version:	5 (50.0%)
Same OS:	6 (60.0%)

From:

marc dot bau at gmx dot net

Assigned:

edink (profile)

Status:

Suspended

Package:

IIS related

PHP Version:

5.2.1

OS:

WinXP

Private report:

CVE-ID:

None

[2006-12-29 14:37 UTC] marc dot bau at gmx dot net

Description:
------------
This code should return a response header of 301, but sends a response header of 302.

I have tested this with PHP 5.1 and 5.2 on IIS with PHP-CGI.

Reproduce code:
---------------
<?php
header("Location: http://example.com", true, 301);
?>

Expected result:
----------------
HTTP Status Code 301

Actual result:
--------------
HTTP Status Code 302

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2006-12-29 17:30 UTC] tony2001@php.net

Cannot reproduce with Apache.

HTTP/1.1 301
Date: Fri, 29 Dec 2006 17:29:55 GMT
Server: Apache/1.3.29 (Unix)
X-Powered-By: PHP/5.2.1RC2-dev
Location: http://example.com
Connection: close
Content-Type: text/html

[2006-12-29 17:59 UTC] marc dot bau at gmx dot net

This is why is selected "IIS related". I cannot repro this with Apache, too. But under IIS it is broken!

[2006-12-29 18:03 UTC] tony2001@php.net

This is why I stated I was using Apache.
Please make sure IIS does not translate 301 to 302.

[2006-12-29 18:03 UTC] marc dot bau at gmx dot net

GET /test.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en;q=0.8,en-us;q=0.6,de-de;q=0.4,es;q=0.2
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=m9qi6v871710hj32f7b5cq6317

HTTP/1.x 302 Object Moved
Server: Microsoft-IIS/5.1
Date: Fri, 29 Dec 2006 18:02:03 GMT
Connection: close
Content-Type: text/html
X-Powered-By: PHP/5.2.0
Location: http://example.com

[2006-12-29 18:05 UTC] marc dot bau at gmx dot net

What are you talking about regarding "Please make sure IIS does not translate 301 to 302." ?

[2006-12-29 18:12 UTC] tony2001@php.net

I mean that IIS might change this code for some reason.
One of the possible ways to check it out would be to install Apache with PHP CGI and verify that it works ok.
Since they share the same code, it would mean that the problem is somewhere else.

[2006-12-29 18:36 UTC] marc dot bau at gmx dot net

Installing Apache on Windows makes no sense to me. I know it is working with Apache 2.0 and CGI on a Linux (SuSE 9.3) box.

ASP Code Example - works:

<%@ Language=VBScript %>
<%
Response.Status="301 Moved Permanently"
Response.AddHeader "Location", "http://www.example.com/"
%>

ASP Headers results:

GET /test.asp HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en;q=0.8,en-us;q=0.6,de-de;q=0.4,es;q=0.2
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=m9qi6v871710hj32f7b5cq6317; ASPSESSIONIDQQBCCSTD=MIFPNOKCDKGFBIKNGDIINLMM

HTTP/1.x 301 Moved Permanently
Server: Microsoft-IIS/5.1
Date: Fri, 29 Dec 2006 18:27:01 GMT
X-Powered-By: ASP.NET
Location: http://www.example.com/
Content-Length: 0
Content-Type: text/html
Cache-Control: private


ColdFusion MX 7.02 Example - Code:

<CFHEADER statusCode="301" statusText="Moved Permanently"> 
<CFHEADER name="Location" value="http://www.example.com/">


CFMX Header Results:

GET /test.cfm HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en;q=0.8,en-us;q=0.6,de-de;q=0.4,es;q=0.2
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=m9qi6v871710hj32f7b5cq6317; ASPSESSIONIDQQBCCSTD=MIFPNOKCDKGFBIKNGDIINLMM

HTTP/1.x 301 Moved Permanently
Server: Microsoft-IIS/5.1
Date: Fri, 29 Dec 2006 18:33:27 GMT
X-Powered-By: ASP.NET
Connection: close
Set-Cookie: CFID=3396;expires=Fri, 12-Jan-2007 18:33:27 GMT;path=/
Set-Cookie: CFTOKEN=156ca9b801cf2d95%2DCF7CD840%2DBCDB%2D4EA9%2D271106C3DB1FE210;expires=Fri, 12-Jan-2007 18:33:27 GMT;path=/
Set-Cookie: JSESSIONID=e0307f68472e511136a6;path=/
Location: http://www.example.com/
Content-Language: de-DE
Content-Type: text/html; charset=UTF-8


All on the same machine this PHP 5.2 is installed, too. Now - i think - IIS is not the cause of this bug.

[2006-12-29 19:16 UTC] marc dot bau at gmx dot net

same results with ISAPI Plugin php5isapi.dll:

GET /test.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en;q=0.8,en-us;q=0.6,de-de;q=0.4,es;q=0.2
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=m9qi6v871710hj32f7b5cq6317; ASPSESSIONIDQQBCCSTD=MIFPNOKCDKGFBIKNGDIINLMM; CFID=3396; CFTOKEN=156ca9b801cf2d95%2DCF7CD840%2DBCDB%2D4EA9%2D271106C3DB1FE210; JSESSIONID=e0307f68472e511136a6

HTTP/1.x 302 Object Moved
Server: Microsoft-IIS/5.1
Date: Fri, 29 Dec 2006 19:15:30 GMT
Connection: close
Content-Type: text/html
X-Powered-By: PHP/5.2.0
Location: http://example.com

[2006-12-30 21:23 UTC] marc dot bau at gmx dot net

hi. i've tested this and nothing is changed. I set a 301 and get a 302.


HTTP/1.x 302 Object Moved
Server: Microsoft-IIS/5.1
Date: Sat, 30 Dec 2006 21:22:05 GMT
Connection: close
Content-Type: text/html
X-Powered-By: PHP/5.2.1RC2-dev
Location: http://www.example.com

[2006-12-31 19:22 UTC] iliaa@php.net

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

[2007-01-01 11:12 UTC] marc dot bau at gmx dot net

Thank you. I will test the latest Snapshot.

Are you able to backport this bugfix? I think this is very important and critical bug for older versions, too.

[2007-01-01 11:28 UTC] marc dot bau at gmx dot net

i'm sorry but i must reopen the case. i tested with snapshot php5.2-win32-200701010730 and i got this:

Isn't this the CVS Version you talked about?


HTTP/1.x 302 Object Moved
Server: Microsoft-IIS/5.1
Date: Mon, 01 Jan 2007 11:26:59 GMT
Connection: close
Content-Type: text/html
X-Powered-By: PHP/5.2.1RC2-dev
Location: http://www.example.com

[2007-01-01 11:49 UTC] marc dot bau at gmx dot net

same with php6.0-win32-200701010930:

HTTP/1.x 302 Object Moved
Server: Microsoft-IIS/5.1
Date: Mon, 01 Jan 2007 11:47:42 GMT
Connection: close
Content-Type: text/html
X-Powered-By: PHP/6.0.0-dev
Location: http://www.example.com

[2007-01-01 16:17 UTC] iliaa@php.net

you need to use the 5.2 CVS snapshot

[2007-01-01 16:22 UTC] marc dot bau at gmx dot net

But i have used the Snapshot php5.2-win32-200701010730 !?

[2007-01-01 16:32 UTC] iliaa@php.net

Then it is probably due to IIS overwriting the Status code. 
Based on the current code in the CVS right now PHP sends the 
redirect code set by your application.

[2007-01-01 16:50 UTC] marc dot bau at gmx dot net

But this won't help me anything if you tell me it should be fixed and it isn't. You should test this on IIS, while it is not working as expected and i cannot fix this myself. 

So - this problem is OPEN until the bug is really fixed. I don't know why your are closing it until it is working.

[2007-01-01 16:53 UTC] iliaa@php.net

From the PHP end of things the issue is resolved, if IIS does 
not properly handle the Status header in the event of 
redirects, that's hardly a PHP problem, no?

[2007-01-01 17:03 UTC] marc dot bau at gmx dot net

If Perl, ColdFusion and ASP Pages are correct and PHP not, what do you think is wrong?

I think PHP! Maybe there is something wrong in the way how the status is set or how the status is transfered to IIS... i don't know if there is something special in IIS, but it looks like a PHP Bug, while all other script languages are correct.

[2007-01-11 10:02 UTC] tony2001@php.net

Edin, could you plz verify if this problem is still valid?

[2007-02-18 12:05 UTC] marc dot bau at gmx dot net

Additional to this a header('HTTP/1.0 404 Not Found') produces a "404 OK".

[2007-02-19 23:23 UTC] edink@php.net

Seems that there is no way a CGI script can convince IIS to output something else than 302 response if you have location header.

Same IIS using Microsofts latest FCGI isapi has no problems with PHP outputing correct status code.

I recommend that you switch to that instead of using raw cgi, the perfomance icrease is dramatic as well.

http://www.iis.net/default.aspx?tabid=1000051

[2007-02-23 13:28 UTC] marc dot bau at gmx dot net

i wonder why there shouldn't be a way to handle this. 

As one example ActiveState (www.activestate.com) Perl have a CGI version and this works well, too. You should spend some time on the Perl Code, maybe there is a small trick inside.

[2007-02-23 13:41 UTC] marc dot bau at gmx dot net

Have a look to this headers. "Undescribed" is are wrong, too. I tryed to use "php5isapi.dll" for PHP extension.


GET /test.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en;q=0.8,en-us;q=0.6,de-de;q=0.4,es;q=0.2
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=nihrgij25siffg5r9dbr17boq5

HTTP/1.x 301 Undescribed
Server: Microsoft-IIS/5.1
Date: Fri, 23 Feb 2007 13:38:19 GMT
X-Powered-By: ASP.NET, PHP/5.2.1
Connection: close
Location: http://www.example.com
Content-Type: text/html

[2007-02-23 14:06 UTC] marc dot bau at gmx dot net

And this comes to me with FastCGI from the URL you provided. Wrong in a different way - and buggy again. Any way to get this bug really fixed?


HTTP/1.x 301 OK
Server: Microsoft-IIS/5.1
Date: Fri, 23 Feb 2007 14:04:43 GMT
X-Powered-By: ASP.NET, PHP/5.2.1
Connection: close
Location: http://www.example.com
Content-Type: text/html