Broken `HeaderSessionIdResolver`

[TimWolla]

Tempest version

git

PHP version

8.4

Operating system

Linux

Description

The HeaderSessionIdResolver is broken:

• The str() function does not exist (missing use).
• The expected header name contains underscores, which cannot appear in $this->request->headers (they are normalized to a hyphen).

[brendt]

Thanks!

#1893 contains a fix for the broken import, which wasn't detected by CI because our testing environment requires laravel blade for testing the blade compatibility layer. Laravel itself has a global str function which is why it all worked in our tests without problems.

Regarding the normalized hyphens: I did add a test for that in the same PR, but as far as I can tell, underscores aren't replaced by hyphens. Maybe you have some more insights in that?

As a sidenote, I'd like to respectfully ask to consider choosing more neutral PR titles and issue descriptions. I'm sure you know the impact an aggressive communication style can have on OSS maintainers. I don't think you had bad intentions with it, but I did want to give you that feedback for the future.

[TimWolla]

Regarding the normalized hyphens: I did add a test for that in the same PR, but as far as I can tell, underscores aren't replaced by hyphens. Maybe you have some more insights in that?

For (Fast)CGI incoming headers are provided as environment variables to PHP. Since they may not contain hyphens, the CGI client (e.g. nginx) replaces them with underscores, resulting in both tempest-session-id and tempest_session_id request headers being provided to PHP as $_SERVER['HTTP_TEMPEST_SESSION_ID'] (the same is true for PHP's built-in CLI server).

Since hyphenated headers are much more common than headers with underscores, all “request object” implementations that I'm aware of, including Laminas' ServerRequestFactory as used by Tempest, turn the underscores back into a hyphen:

https://github.com/laminas/laminas-diactoros/blob/ab5853da050bf8aee30f918f7d7e8d60e7b503ce/src/functions/marshal_headers_from_sapi.php#L57

Which makes it impossible for headers containing underscores to appear in practice.