Response headers include received Authorization header

[geirp]

The Response constructor will by default create a Headers object to collect headers to be sent. The Headers constructor will call setHeaders() which will call parseAuthorizationHeader(). parseAuthorizationHeader() will try to create an Authorization header from data found in $_SERVER.

The result of this is that the Response headers include a copy of the Authorization header received in the request being processed.

The code comment for parseAuthorizationHeader() reads: "Parse incoming headers and determine Authorization header from original headers". My interpretation is that this code was never intended to be used for a Response.

[l0gicgate]

We need to fix this @adriansuter . This is definitely a bug. We may have to create RequestHeaders and ResponseHeaders which will could extend an abstract Headers object instead so we can differentiate their origins. While they are similar, parseAuthorizationHeader should not be called when we instantiate response headers.

[adriansuter]

Isn't it possible to simply provide the globals here, or do we need them elsewhere?

Slim-Psr7/src/Response.php

Line 127 in 1f8bb50

$this->headers = $headers ? $headers : new Headers();

That is

        $this->headers = $headers ? $headers : new Headers([], []);

I quickly made a test and run phpunit.

    // \Slim\Tests\Psr7\ResponseTest
    public function testResponseHeadersDoNotContainAuthorizationHeader()
    {
        $_SERVER = Environment::mock(
            [
                'PHP_AUTH_USER' => 'foo'
            ]
        );

        $response = new Response();
        $this->assertEmpty($response->getHeaders());
    }

https://github.com/adriansuter/Slim-Psr7/blob/3ae1689e9b8177d50ec35de1ba35fa93dd28e4f4/tests/ResponseTest.php#L170-L180

The test fails without the modification mentioned above. But with the change, all tests succeed. Could that be a BC? Is it too hackish?

[adriansuter]

@l0gicgate what do you think?

[l0gicgate]

@adriansuter that would also work yes. Probably the simplest fix.