') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); Bug: Security class sends cookies immediately, instead of coordinating with the Response class. · Issue #5406 · codeigniter4/CodeIgniter4 · GitHub
Skip to content

Bug: Security class sends cookies immediately, instead of coordinating with the Response class. #5406

Closed
#5429
Closed
Bug: Security class sends cookies immediately, instead of coordinating with the Response class.#5406
#5429
Labels
bugVerified issues on the current code behavior or pull requests that will fix them

Description

@lonnieezell
lonnieezell
opened on Nov 29, 2021

PHP Version

7.4

CodeIgniter4 Version

4.1.5

CodeIgniter4 Installation Method

Git

Which operating systems have you tested for this bug?

macOS

Which server did you use?

cli-server (PHP built-in webserver)

Database

n/a

What happened?

Originally encountered during Feature testing. Code that passed previously is now giving errors that Cannot modify header information - headers already sent by. This appears to be happening while the CSRF token is being set while calling a page using the FeatureTestTrait.

Steps to Reproduce

Create a test using FeatureTestTrait. Use that to call a page that is protected with a CSRF hash. Run test.

Expected Output

Instead of sending the cookie immediately, it should add the cookie to the Response class, which then sends all cookies out at once to protect against the possibility of sending cookies early and giving the Output already started errors.

Anything else?

This appears to require letting the Response class (or ResponseTrait?) know how to handle raw cookies, also, in order to completely remove that functionality from the Security class.

Relevant trace:

ErrorException: Cannot modify header information - headers already sent by (output started at /Users/kilishan/WebSites/personal/Bonfire2/vendor/phpunit/phpunit/src/Util/Printer.php:104)
/Users/kilishan/WebSites/personal/Bonfire2/vendor/codeigniter4/framework/system/Cookie/CookieStore.php:248
/Users/kilishan/WebSites/personal/Bonfire2/vendor/codeigniter4/framework/system/Cookie/CookieStore.php:172
/Users/kilishan/WebSites/personal/Bonfire2/vendor/codeigniter4/framework/system/Security/Security.php:521
/Users/kilishan/WebSites/personal/Bonfire2/vendor/codeigniter4/framework/system/Security/Security.php:507
/Users/kilishan/WebSites/personal/Bonfire2/vendor/codeigniter4/framework/system/Security/Security.php:493
/Users/kilishan/WebSites/personal/Bonfire2/vendor/codeigniter4/framework/system/Security/Security.php:467
/Users/kilishan/WebSites/personal/Bonfire2/vendor/codeigniter4/framework/system/Security/Security.php:188
/Users/kilishan/WebSites/personal/Bonfire2/vendor/codeigniter4/framework/system/Config/Services.php:552
/Users/kilishan/WebSites/personal/Bonfire2/vendor/codeigniter4/framework/system/Config/BaseService.php:248
/Users/kilishan/WebSites/personal/Bonfire2/vendor/codeigniter4/framework/system/Config/BaseService.php:189
/Users/kilishan/WebSites/personal/Bonfire2/vendor/codeigniter4/framework/system/Config/Services.php:547
/Users/kilishan/WebSites/personal/Bonfire2/vendor/codeigniter4/framework/system/Config/BaseService.php:248
/Users/kilishan/WebSites/personal/Bonfire2/vendor/codeigniter4/framework/system/Common.php:243
/Users/kilishan/WebSites/personal/Bonfire2/vendor/codeigniter4/framework/system/Common.php:277

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugVerified issues on the current code behavior or pull requests that will fix them

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions