How to return an HTTP 500 code on any error, no matter what

I'm writing an authentication script in PHP, to be called as an API, that needs to return 200only in the case that it approves the request, and403(Forbidden) or500` otherwise.

The problem I'm running into is that php returns 200 in the case of error conditions, outputting the error as html instead. How can I make absolutely sure that php will return an HTTP 500 code unless I explicitly return the HTTP 200 or HTTP 403 myself? In other words, I want to turn any and all warning or error conditions into 500s, no exceptions, so that the default case is rejecting the authentication request, and 开发者_运维知识库the exception is approving it with a 200 code.

I've fiddled with set_error_handler() and error_reporting(), but so far no luck. For example, if the code outputs something before I send the HTTP response code, PHP naturally reports that you can't modify header information after outputting anything. However, this is reported by PHP as a 200 response code with html explaining the problem. I need even this kind of thing to be turned into a 500 code.

Is this possible in PHP? Or do I need to do this at a higher level like using mod_rewrite somehow? If that's the case, any idea how I'd set that up?

---

Simply send the status code as a response header():

header('HTTP/1.1 500 Internal Server Error');

Remember that when sending this there must not be any output before it. That means no echo calls and no HTML or whitespace.

---

I checked the PHP docs for header(), and it's simpler than I was making it - if the second parameter is true, it will replace a similar header. the default is true. So the correct behavior is header ('HTTP/1.1 403 Forbidden');, then do the authentication logic, then if it authenticates, do header ('HTTP/1.1 200 OK'). It will replace the 403 response, and will guarantee that 403 is the default.

---

Since PHP 5.4.0 there is a specialized function:

<?php http_response_code( 500 ); ?>

Just make sure that it's called before any other output.

Reference:

• https://www.php.net/manual/en/function.http-response-code.php

---

On the php page for set_error_handler() you can find a comment by smp at ncoastsoft dot com posted on 08-Sep-2003 10:28 which exlpains how to even catch fatal errors (which you can normally not catch with a custom error handler. I changed the code for you needs:

error_reporting(E_ALL);
ini_set('display_errors', 'on');

function fatal_error_handler($buffer) {
    header('HTTP/1.1 500 Internal Server Error');
    exit(0);
}

function handle_error ($errno, $errstr, $errfile, $errline){
    header('HTTP/1.1 500 Internal Server Error');
    exit(0);
}

ob_start("fatal_error_handler");
set_error_handler("handle_error");

//would normally cause a fatal error, but instead our output handler will be called allowing us to handle the error.
somefunction();
ob_end_flush();

This shold catch the fatal error of the non existing function. It than returns a 500 and stops the execution of the rest of the script.

---

header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');

You should not use 500, that indicates an internal server error.

This (and other headers) should be sent before any ouput, except if you have output buffering enabled.

---

Curious if you ever figured out how to get PHP to return 500 on Parse errors... I have the same exact need... API is posting to our app and expects a 200 only if everything was processed correctly...

In the case of a Parse error, PHP returns an Error 200 and I have used both of these functions:

register_shutdown_function() set_error_handler()

and these don't get hit when a "parse/syntax" error happens in the code...

So this is a low-level PHP function that would have to be set in the PHP.INI or somewhere... I am using PHP 5.3.10...

---

Use output buffering to allow you to modify the headers after writing to the body of the page. You can set this in the ini file rather than updating every script.

(Note the header() call will still fail if you explicitly flush the output buffer)

C.