Unexpected Cookies sent if persistent_handle_id is used

[rcanavan]

Given the following trivial test program that always sends a cookie "test" and, if Cookie "test" was received, the additional cookie "test2":

<?php if (!empty($_COOKIE["test"])) setcookie("test2", $_COOKIE["test"]); setcookie("test", "1"); echo "done";

Then ext-httpd 3.0.1 unexpectedly sends the "test" cookie in the second request of the test program below:

<?php                                                                                                                                                            
$url = 'http://192.168.56.1:14080/cookie.php';                                                                                                                   

foreach (array('a', 'B') as $id) {
    $client = new http\Client('curl', $id);
    $req1 = new  http\Client\Request('GET', $url);
    $client->enqueue($req1);
    $client->send();
    $response1 = $client->getResponse($req1);
    fprintf(STDERR, ">%s<\n", print_r($response1->getHeaders(), true));
    printf("curl: %s http: %s\n\n\n", $response1->getTransferInfo('curlcode'), $response1->getTransferInfo('response_code')); 
}

i.e. the output contains test2=1, although the persistent handle was different for each request, and both client and request were new objects:

[Set-Cookie] => Array
    (
        [0] => test2=1
        [1] => test=1
    )

This bahaviour is not present if no persistent handle id is used.

[m6w6]

Ugh, ouch.

Here's a quick fix: persistent_request.txt

Thank you for the report!

[rcanavan]

Thanks, the quick fix actually fixes this problem for me.

[rcanavan]

I may have spoken too soon. I'd actually expect the test program not to send the Cookies even if the persistent_handle_id is identical for two requests. Replacing the array with e.g. array('a', 'a') returns to the faulty behaviour, even though var_dump($client->getCookies()); appears to indicate that no cookies are present.

Do I have to explicitly disable cookie handling in the request or client? So far I've tried various combinations and variants of $req1->setOptions(array('cookies' => array(), 'cookiestore' => NULL, 'cookiesession' => false)); without success.

[m6w6]

No, if you don't want to share anything, don't use persistent handles, or use different ids.

http\Client::getCookies() just returns static cookies set by http\Client::setCookies().

More thorough cookie handling like flushing etc. is still on a TODO.

[rcanavan]

My plan was to use persistent handles to only recycle TCP and SSL Connections, but not other states, such as Cookies or e.g. the proxy configuration. Is any Documentation available or can you give hints how that could be achieved, or what features may be missing for that to work?

[m6w6]

Since the v2.0 refactoring, we're missing support for CURLOPT_COOKIELIST, because curl_easy handles do not have any userland representation anymore.

If you need the recycling only per server request (i.e. single script runtime), then don't use persistent handles.

[m6w6]

I'm currently working on a patch, which might work contrary to your liking, though.

I think the client should behave more like a client is supposed to, i.e. share more between it's requests.

The idea is to include a curl_share handle in the client, which enables cookie and TLS session sharing for all requests of this client.

[rcanavan]

I'd appreciate if you could make this behavior switchable.

In my opinion, it's a useful feature to use pecl_http so to be used in "proxy mode", such that any secrets such as cookies are transparently passed between the user and the system pecl_http communicates with, so that they don't need to be stored on the PHP server and associated with a session there. Persistence still provides a significant performance advantage in this case.

As far as I'm aware, one cannot share any relevant TLS secrets between the connections between the user and PHP on one hand via pecl_http on the other hand - things like client certificates would typically be constant and shared for all pecl_http requests to a given sever.

[m6w6]

So, I added curl_share support to the client, which means, that cookies and ssl session info is now shared in a meaningful way across all queued requests, unless you disable it:

$client->configure(["share_cookies" => false, "share_ssl" => false]);

Would you mind giving current HEAD a try?

Thank you.

[afflerbach]

On behalf of @rcanavan I tried 54059a4 and can confirm that the issue is now gone.
"share_cookies" => false is needed in our case and works as one would expect. Thank you!

[m6w6]

Thanks!