PHP's 20-Year Secret Is Finally Out

For two decades, a subtle but significant security flaw in PHP quietly compromised countless applications. Since 2003, the widely used file_get_contents function, intended for fetching URL content, automatically followed HTTP redirects without question. This seemingly innocuous feature created a severe vulnerability, inadvertently exposing sensitive user data.

When a script used file_get_contents to access an API and included an Authorization header (containing bearer tokens or other credentials), PHP would blindly forward this header to any new domain specified in a redirect. The system assumed the new destination was trustworthy, continuing to send authentication details even if the redirect pointed to an entirely different server.

The most dangerous scenario involved an HTTPS-to-HTTP downgrade. If an initial secure request redirected to an unencrypted HTTP endpoint, PHP still sent the sensitive tokens. This meant credentials, originally protected by TLS, traveled completely unencrypted across the network, making them trivially interceptable by malicious actors. This silent forwarding mechanism put countless applications at risk.

The core problem was PHP's silent forwarding of sensitive data during redirects. Thankfully, a new patch finally addresses this decades-old issue, introducing a critical security check. Now, if a redirect changes the scheme (like HTTP to HTTPS), host, or port, PHP intelligently strips the Authorization and Cookie headers. This crucial intervention prevents your sensitive credentials from inadvertently traveling to an unintended, potentially malicious, new server.

To benefit from this crucial security update, developers must update their PHP installations promptly. The fix is available in the latest patch releases for PHP versions 8.2 through 8.5. Updating ensures your server runs a version that actively protects against this specific credential leakage, closing a significant security gap that has existed for years.

Crucially, this patch doesn't solve every credential leakage scenario. The official fix only applies to the standard Authorization and Cookie headers, which are widely recognized. Any custom headers you might use, such as an X-API-Key or other bespoke tokens, remain vulnerable to the same redirect trap. These custom credentials will still be forwarded automatically to the new server, requiring careful manual handling.

Many developers using Laravel's HTTP client or the underlying Guzzle library were already protected from this two-decade-old vulnerability. Guzzle, a robust HTTP client, manages redirects with a security-first mindset. It explicitly avoids blindly forwarding sensitive headers like Authorization or Cookie when redirecting to a different scheme, host, or port, offering a much safer approach than PHP's native file_get_contents.

PHP's new patch (available in versions 8.2 through 8.5) addresses Authorization and Cookie headers, but it doesn't cover everything. Any custom headers you send, like an X-API-Key, will still be forwarded during a redirect, potentially leaking sensitive credentials. To truly secure these, you must disable PHP's automatic redirects by setting the follow_location context option to false for file_get_contents.

Implementing your own secure redirect logic requires careful steps. Manually inspect the HTTP response for a 30x status code. If a redirect occurs, extract the Location header to get the new URL. Crucially, validate the domain of this new URL against your trusted list before initiating a fresh request. This new request should explicitly exclude any sensitive custom headers, ensuring your credentials never reach an unintended destination. For more context on related fixes, see CVE-2026-91766: PHP had the redirect credential leak curl fixed in 2018.

Two-decade persistence of this redirect bug in PHP offers a stark lesson in the complexities of maintaining mature languages. Core functionalities, like file_get_contents, embedded deeply for years, can harbor subtle vulnerabilities that elude detection even as the language evolves. Discovering and fixing issues from 2003 now shows the immense challenge of ensuring security across a vast, long-lived codebase.

Despite perennial "PHP is dead" narratives, this crucial fix for versions 8.2 through 8.5 underscores the language’s vibrant, ongoing development. Modern PHP, particularly with robust frameworks like Laravel, consistently delivers high-quality applications, proving its enduring relevance. Its powerful ecosystem, with libraries like Guzzle handling redirects securely by default, often provides built-in safeguards.

Ultimately, PHP’s community demonstrated its unwavering commitment to modernizing and securing the language with this patch. Addressing a legacy vulnerability spanning two decades reinforces trust and showcases proactive security improvements. This dedication ensures PHP remains a powerful, relevant choice for web development, constantly adapting to new security landscapes and building a stronger foundation for the future.

What was the PHP authorization header leak bug?

For over 20 years, PHP functions like file_get_contents would automatically follow HTTP redirects and forward sensitive headers, like Authorization, to the new destination. This could happen even if the redirect was to a different server or from secure HTTPS to insecure HTTP.

Which versions of PHP have the fix?

The patch is available in the latest releases for PHP versions 8.2, 8.3, 8.4, and 8.5. You must update to the latest patch version within these series to be protected.

Does the new PHP patch fix all header leaks?

No. The official fix only strips the standard Authorization and Cookie headers during cross-domain redirects. Custom headers, such as X-Api-Key, are not stripped and will still be leaked.

Was Laravel affected by this PHP bug?

No. Laravel's default HTTP client is built on Guzzle, which implements its own, more secure redirect handling logic. Guzzle does not forward sensitive headers to different hosts, so Laravel applications were not vulnerable to this specific issue.