Closed
Description
Description
E.g. the ´Forwarded` header might appear more then once, NGinx and Apache correctly merge them into a comma separated list.
But the built-in server does not and just passes the first header set.
To test:
<?php
// index.php
var_dump($_SERVER['HTTP_FORWARDED']);
Run with:
php -S localhost:8000
Test with curl:
curl -v -H 'Forwarded: for=127.0.0.1' -H 'Forwarded: for=unknown' localhost:8000
* Host localhost:8000 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
* Trying [::1]:8000...
* Connected to localhost (::1) port 8000
* using HTTP/1.x
> GET / HTTP/1.1
> Host: localhost:8000
> User-Agent: curl/8.10.1
> Accept: */*
> Forwarded: for=127.0.0.1
> Forwarded: for=unknown
>
* Request completely sent off
< HTTP/1.1 200 OK
< Host: localhost:8000
< Date: Mon, 30 Sep 2024 17:28:59 GMT
< Connection: close
< X-Powered-By: PHP/8.3.11
< Content-type: text/html; charset=UTF-8
<
string(13) "for=127.0.0.1"
Expected output:
for=127.0.0.1,for=unknown
PHP Version
8.3.11
Operating System
openSUSE Tumbleweek