ServerRequest::fromGlobals can produce incorrect results

[Firehed]

PHP version: 7.4.12 (not relevant)

Description
ServerRequest::fromGlobals() is producing an object with Content-length and Content-type set to '' on GET requests when neither header is present. This differs from the behavior of the abandoned Zend Diactoros equivalent, which strips those values from the superglobals when empty. I haven't cross-checked other implementations.

How to reproduce
var_dump(\GuzzleHttp\Psr7\ServerRequest::fromGlobals()->getHeader('content-type')) on any GET request.

This appears to be specific to some server configurations, including common/default nginx configs: fastcgi_params can set the $_SERVER['CONTENT_TYPE'] and $_SERVER['CONTENT_LEGNTH'] to empty string values.

Possible Solution
Something functionally equivalent to:

- $headers = getallheaders();
+ $headers = array_filter(getallheaders(), fn ($v) => $v !== '');

Given the PHP versions this supports, it would need a bit of adjusting.

It may be more appropriate to handle elsewhere, as I think empty header values violate the actual HTTP specs.

Additional context
While this can probably be worked around by changing server configs, this is not expected out-of-the-box behavior, and differs from other similar PSR-7 implementations.

This can similarly be worked around in user-code in the same way, but walking and stripping headers is less performant than doing it at the source in the library, and is probably marginally more error-prone when considering how repeated headers work.

[GrahamCampbell]

This is a breaking change we could make on 2.x, if we think this behaviour is better.

[bbrala]

The http 1.1 spec does say the only valid value for this header is an integer greater than 0. I think it would make sense not to keep the empty headers.

[GrahamCampbell]

I think it would make sense not to keep the empty headers.

Seems fair. I'd be happy to make this change on 2.x 2.0.0 is coming out in the next few weeks. :)

[GrahamCampbell]

If you'd like to send a PR @bbrala to do that, that's be great. :)

[bbrala]

Sure, i would only filter the content headers though so we don't get possible weird side effects.

[bbrala]

There you go :)

[bbrala]

Ok, stripping empty headers is a bad idea. Some parts of http allow empty headers, http2 also. This issue is a good source of multiple other sources: jetty/jetty.project#1116

[GrahamCampbell]

Conclusion here is that this is not incorrect.

[GrahamCampbell]

Zend is actually implementing this wrong.