W3TC’s php_flag causing 500 Internal Server Error

I also have this issue. Its just cropped up in the last few days.

as a temporary fix I changed my .htaccess permissions to 444 (removing write access from the plugin) then removed the php_flag lines and saved.

Until there is a fix I will need to remain this way. Does anyone know the actual settings that set the php_flag variables? I’m thinking its on the Browser cache page

Yup way back last year when w3tc-fixed (the community version of w3tc) was first to implement Security Headers — so before the official W3TC finally inserted their code in v0.9.7 — they discovered this problem of php_flag not being universally compatible with servers so they removed the php_flag setting from htaccess/nginx.conf and made them into @ini_set function calls within php instead which when you think about it makes more sense since these specific ones relate to session cookies:

session.use_only_cookies
session.cookie_httponly
session.cookie_secure

And because these sessions cookies are only set prior to caching (via the session_start() function call) it should only be defined when a cache is going to occur not repeatedly on existing cached files.

disk:enhanced existing cached files dont pass session cookies to visitors (since cookies aren’t cached by it) so having the php_flag in the htaccess is not technically the best place for it; and as you have found has lead to incompatibility issues. Instead, it should be set via @ini_set in BrowserCache_Plugin.php.

It seems when the author took the Security Headers code from the community build he mistakenly put back php_flag for the official w3tc latest release, not realizing the discussion those folks over there had about the issue, which is why this once fixed problem has now returned. 🙁

Anyway, to fix this yourself isn’t difficult. Just do the following:

1. Open “BrowserCache_Environment.php“
2. Go to line 337 and 675. Replace: $sec = ''; with: /*$sec = '';
3. Go to line 364 and 693. Replace: } with: }*/
4. Open “BrowserCache_Plugin.php”
5. Go to line 43. There should just be }. Insert a new blank line before it.
6. Add the following code:

$v = $this->_config->get_string( 'browsercache.security.session.cookie_httponly' );
if ( !empty( $v ) ) {
	@ini_set( 'session.cookie_httponly', $v == 'on' ? '1': '0' );
}
$v = $this->_config->get_string( 'browsercache.security.session.cookie_secure' );
if ( !empty( $v ) ) {
	@ini_set( 'session.cookie_secure', $v == 'on' ? '1': '0' );
}		
$v = $this->_config->get_string( 'browsercache.security.session.use_only_cookies' );
if ( !empty( $v ) ) {
	@ini_set( 'session.use_only_cookies', $v == 'on' ? '1': '0' );
}

7. Save both modified files and upload them back to your host.

@peterallcdn

you are very welcome, although when removing the php_flags and aftersaving the file you should change the file permissions (chmod) on the .htaccess file to 444 removing the write access, that stops w3tc overwriting it until you can try @fistfullofcrisco recommendation or get into the browser cache page to remove the settings.