3 ms·
Sounds more like a language issue. $_SERVER is an array containing information such as headers, paths, and script locations. You may or may not find a
by Cakez0r 11y ago
Sounds more like a language issue.
$_SERVER is an array containing information such as headers, paths, and script locations.
You may or may not find any of the following elements in $_SERVER.
'HTTPS'
Set to a non-empty value if the script was queried through the HTTPS protocol.
https://secure.php.net/manual/en/reserved.variables.server.php https://secure.php.net/manual/en/reserved.variables.server.p...
- detaro 11y agoBut then the environments violate that specification if they set this variable off a random HTTP header?
- Cakez0r 11y agoIf the language spec says that $_SERVER['HTTPS'] is an indicator of whether the request was made over HTTPS, then it should ensure that it adheres to its own spec (I.E. not overwrite $_SERVER['HTTPS'] with the value from a header, if it's present).
- nolok 11y agoIt does. The problem is in Apache, not the language. Apache's says to look into the HTTPS variable (that it adds itself before passing the call to the handler) to know if the call was made over https, but then it overwrite that variable with the browser-sent header if there is one (or more exactly, it uses the same variable name for that header and it's own HTTPS indicator; so it overwrites if both are present, and if only the header is present then it creates it when it shouldn't -- the issue in this post).
- TazeTSchnitzel 11y agoThat's not an issue with PHP itself. $_SERVER maps directly to CGI variables (or equivalents provided by the web server in non-CGI environments).