Home/ Questions/Q 6984399
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T18:32:40+00:00

A centain web client that I need to support, is sending back the Cookies

  • 0

A centain web client that I need to support, is sending back the Cookies header to my application twice in the HTTP headers, this in turn is making PHP unable to read the correct value for the cookie thus ignoring the session.

Here is the relevant part of the request I am seeing:

GET / HTTP/1.1
Cache-Control: max-age=0
Accept-Language: en-US
Cookie: PHPSESSID=49af82ddf12740e6a35b15985e93d91a
Connection: Keep-Alive
Cookie: PHPSESSID=49af82ddf12740e6a35b15985e93d91a
[...] Other irrelevant headers

I have two questions:

Is that a PHP bug? or is the behavior undefined when the client sends that same header twice?

Is there a quick workaround to make things work without having to manually parse the HTTP headers so I can read the right value of the cookie (and session) in my application? Or should I manually parse the HTTP header to set the session to its correct value?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    According to the HTTP spec, a double header simply concatenates the values together with a comma, making it:

    Cookie: PHPSESSID=49af82ddf12740e6a35b15985e93d91a, PHPSESSID=49af82ddf12740e6a35b15985e93d91a

    PHP should be able to parse the cookies, but the behavior of sessions is undefined when there are two session IDs.

    I strongly recommend fixing the client. If that’s not an option, you’ll have to parse the headers manually.

    • 0