Content-Length header and Internal Server Error

Question

I have a PHP-driven website that uses output buffering, generates the entire page and spits out a couple of headers (Content-Type and Content-Length) before sending the actual page contents.

This works fine on my local Apache server but as soon as I uploaded it to my web host (also Apache), it failed with a 500 Internal Server Error, which I finally traced to the Content-Length header. I simply removed the header (it isn't really important) and it works fine since.

Now I'm just curious as to why this happened in the first place - is there some kind of server setting that disallows scripts from adding this specific header?

Answer 1

I could be wrong, but I think it's disallowed by either one of the optional PHP security settings or by the Suhosin PHP protection system many servers use.

I think I remember reading something about how mismatches between Content-Length and the actual content length could be used for exploits and, therefore, that both PHP+Suhosin and the browser's xmlHttpRequest Javascript object insist on setting that header for you.

Answer 2

Generally, if you set a response header after some portion of the body has already been sent, you will get an error. It is possible that in production the size of the content is greater than the output buffer, because of which the server started to send data to the client. This is likely to cause the error that you describe.

Try to answer these questions and you should end up with the solution -

1. Use a http proxy and inspect the error response. Do you get some html content along with the 500 error code?
2. What is the size of the output buffer, and is the size of the response greater than the buffer size?
3. Is the buffer size same in production as compared to local machine?