Re: [tlug] What's the deal with HTTP_ACCEPT? (Was: Wanna see my open source project?)

[Edward Middleton <emiddleton@example.com>]

Dave M G wrote:
> $ac = strtolower($_SERVER['HTTP_ACCEPT']);
>
> Long story short - some browsers don't send back a value for 
> HTTP_ACCEPT, so it is not even empty, the entry doesn't even exist in 
> the $_SERVER array. Since this variable is being looked at *before* 
> the session starts, somehow the act of discovering it isn't there 
> causes a session to get started, but not with the right data (probably 
> a mostly empty $_SESSION array). From that point on, the mangled 
> session causes everything to die horribly.
>
> But I'm puzzled why this one entry in $_SERVER is so problematic. If 
> it can't be found, why not simply return null or an empty string?

Because it isn't mandatory to include an accept header[1].

I am not sure why you would expect it to behave differently.  Isn't 
$_SERVER['HTTP_ACCEPT'] dereferencing a hash with 'HTTP_ACCEPT' as the 
key.  If there isn't a key then shouldn't it throw an exception or 
something.

Returning an empty string would be wrong because that would indicate the 
requester doesn't accept anything, where as the correct interpretation 
is '*/*' or accepts all.

Thus this

else
 {
   $ac = '';
}

should be

else
 {
   $ac = '*/*';
}

because '' would indicate it doesn't support any types and "then the 
server SHOULD send a 406 (not acceptable) response. "

Edward

1. http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html