invalid header {"header": "Access-Control-Allow-Origin:*"}

[fcwys]

What happened?

2024/02/01 03:03:23.520	DEBUG	invalid header	{"header": "Access-Control-Allow-Origin:*"}
2024/02/01 03:03:23.520	DEBUG	invalid header	{"header": "Content-Type:application/json; charset=utf-8"}

Build Type

Standalone binary

Worker Mode

Yes

Operating System

GNU/Linux

CPU Architecture

x86_64

Relevant log output

No response

[dunglas]

The header is invalid. A space is missing after the colon.

Does FPM correct that automatically?

[fcwys]

I tested it normally in the PHP environment, but I don't know why

[fcwys]

Tested, it seems that there was no automatic correction.

After changing header('Access-Control-Allow-Origin:*'); to header('Access-Control-Allow-Origin: *');, it worked normally, but it ran normally in the previous PHP environment.

[dunglas]

What was the previous PHP environment? Were the headers sent to the client or just ignored?
We display this log on purpose to be able to catch these kinds of errors instead of silencing them.

[fcwys]

The previous environment was PHP 8.0.2 and Nginx 1.25.2. In the above error, the header was not sent to the client. After correction, the client was able to receive the correct header.Before the fix, client requests were affected, but after the fix, they worked normally on FrankenPHP.

[dunglas]

Ok, with NGINX+FPM clients weren't receiving the header right? So we can close as this works as expected.

[fcwys]

Ok

[rasteiner]

Just a friendly heads up, because I ran into this today :)

According to HTTP/1.1 specs, any amount of whitespace after the colon should be optional and ignored.

Or, if you prefer the more readable MDN:

a header is a case-insensitive name followed by a colon, then optional whitespace which will be ignored, and finally by its value

[dunglas]

Il, I wasn't aware of this. PR welcome, it should be an easy fix (I'll do it when I'll be back from vacation if still needed)

[withinboredom]

I believe it is still working correctly, with the following php:

<?php

header("X-Test-Correct: hello world");
header("X-Test-Incorrect:hello world");

I see the following headers in my browser console going through php + fpm:

I do not see X-Test-Incorrect as a listed header.

[rasteiner]

Il, I wasn't aware of this. PR welcome, it should be an easy fix (I'll do it when I'll be back from vacation if still needed)

I guess it would be fixed by splitting on ":" rather than ": " here
https://github.com/dunglas/frankenphp/blob/be2e4714f5624ba48824af07ad5e41ffafacda1b/frankenphp.go#L566

but I'm not familiar enough with golang to know if we also need to left-trim the value then or if Header().Add() already does, or if it doesn't actually matter