Repository navigation
Conversation
Worker mode shares state across requests like a long-running CLI script. Resetting strtok() and http_get_last_response_headers() made state unrelated to the HTTP request behave differently from userland state. The URL rewriter is still reset because it belongs to the response output.
error_get_last() and libxml_get_errors() report engine and extension state unrelated to the HTTP request. Like other shared state in worker mode, the application clears it when needed.
henderkes
reviewed
Oct 31, 2026
henderkes
left a comment
henderkes
left a comment
Contributor
There was a problem hiding this comment.
Huh, I didn't even notice this was added.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
After a discussion with @TimWolla about a proposal to introduce "logical" HTTP requests hook in php-src, I think introducing reset of states not built from an incoming request in worker mode was a mistake.
Worker mode shares state between the requests a thread handles, like a long-running CLI script. FrankenPHP should only resets the state tied to the HTTP request being handled: superglobals (except
$_ENV), the request body, response headers and output, and the session. That's all.Recent releases also reset state unrelated to the request as "security" issues. This was design mistake of mine.
This PR removes those resets:
strtok()andhttp_get_last_response_headers()(added in 1.13.4)error_get_last(),libxml_get_errors()andlibxml_get_last_error()(added in 1.13.2)I'll also retract the related security advisories and update the related release note. This a breaking change, but introducing these changes were also breaking changes, and bad design.
Better fix it now as this has been released recently.
Resetting them made some engine and extension state behave differently from userland state, which persists anyway. Applications that need a clean state can call
error_clear_last(),libxml_clear_errors()andhttp_clear_last_response_headers().The URL rewriter (
output_add_rewrite_var(),session.use_trans_sid) is still reset, because it rewrites the response output.The worker mode and security docs now state this rule and list the state that persists.