Sorry the description is lacking.

To clarify some things, this is a zf3 application running in a docker container

Here is the dump of xdebug config:

docker exec -it cmwn_api_php php --ri xdebug

xdebug

xdebug support => enabled
Version => 2.4.1
IDE Key =>

Supported protocols => Revision
DBGp - Common DeBuGger Protocol => $Revision: 1.145 $

Directive => Local Value => Master Value
xdebug.auto_trace => Off => Off
xdebug.trace_enable_trigger => Off => Off
xdebug.trace_enable_trigger_value => no value => no value
xdebug.trace_output_dir => /tmp => /tmp
xdebug.trace_output_name => trace.%c => trace.%c
xdebug.trace_format => 0 => 0
xdebug.trace_options => 0 => 0
xdebug.coverage_enable => On => On
xdebug.collect_includes => On => On
xdebug.collect_params => 0 => 0
xdebug.collect_return => Off => Off
xdebug.collect_vars => Off => Off
xdebug.collect_assignments => Off => Off
xdebug.default_enable => On => On
xdebug.extended_info => On => On
xdebug.file_link_format => no value => no value
xdebug.force_display_errors => Off => Off
xdebug.force_error_reporting => 0 => 0
xdebug.halt_level => 0 => 0
xdebug.max_nesting_level => 256 => 256
xdebug.max_stack_frames => -1 => -1
xdebug.overload_var_dump => 2 => 2
xdebug.show_error_trace => Off => Off
xdebug.show_exception_trace => Off => Off
xdebug.show_local_vars => Off => Off
xdebug.show_mem_delta => Off => Off
xdebug.dump.COOKIE => no value => no value
xdebug.dump.ENV => no value => no value
xdebug.dump.FILES => no value => no value
xdebug.dump.GET => no value => no value
xdebug.dump.POST => no value => no value
xdebug.dump.REQUEST => no value => no value
xdebug.dump.SERVER => no value => no value
xdebug.dump.SESSION => no value => no value
xdebug.dump_globals => On => On
xdebug.dump_once => On => On
xdebug.dump_undefined => Off => Off
xdebug.profiler_enable => Off => Off
xdebug.profiler_output_dir => /tmp => /tmp
xdebug.profiler_output_name => cachegrind.out.%p => cachegrind.out.%p
xdebug.profiler_enable_trigger => Off => Off
xdebug.profiler_enable_trigger_value => no value => no value
xdebug.profiler_append => Off => Off
xdebug.profiler_aggregate => Off => Off
xdebug.remote_enable => On => On
xdebug.remote_handler => dbgp => dbgp
xdebug.remote_host => 10.1.11.231 => localhost
xdebug.remote_mode => req => req
xdebug.remote_port => 9001 => 9001
xdebug.remote_autostart => Off => Off
xdebug.remote_connect_back => Off => Off
xdebug.remote_log => no value => no value
xdebug.idekey => no value => no value
xdebug.remote_cookie_expire_time => 3600 => 3600
xdebug.remote_addr_header => no value => no value
xdebug.var_display_max_children => 128 => 128
xdebug.var_display_max_data => 512 => 512
xdebug.var_display_max_depth => 3 => 3
xdebug.cli_color => 0 => 0
xdebug.scream => Off => Off

Here is a var_dump of $_ENV:

http --verify=no OPTIONS https://api-local.changemyworldnow.com Origin:local.changemyworldnow.com
HTTP/1.1 200 OK
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Wed, 08 Feb 2017 22:44:35 GMT
Server: nginx
Set-Cookie: XDEBUG_SESSION=www-data; expires=Wed, 08-Feb-2017 23:44:35 GMT; Max-Age=3600; path=/
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-Powered-By: PHP/7.0.11

<pre class='xdebug-var-dump' dir='ltr'>
<small>/var/www/public/index.php:3:</small>
array (size=48)
'PATH' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'</font> (length=60)
'HOSTNAME' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'ed3c2168fa24'</font> (length=12)
'DATABASE1_USER' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'**'</font> (length=9)
'CACHE1_HOST' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'**'</font> (length=14)
'XDEBUG_CONFIG' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'remote_enable=1 remote_mode=req remote_port=9001 remote_connect_back=0 remote_host=10.1.11.231'</font> (length=94)
'PHP_XDEBUG_ENABLED' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'1'</font> (length=1)
'APP_ENV' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'dev'</font> (length=3)
'DATABASE1_NAME' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'**'</font> (length=4)
'DATABASE1_PASS' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'**'</font> (length=9)
'DATABASE1_HOST' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'api_mysql'</font> (length=9)
'PHP_IDE_CONFIG' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'serverName=api-local.changemyworldnow.com'</font> (length=41)
'no_proxy' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'.local, 169.254/16'</font> (length=19)
'PHPIZE_DEPS' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'autoconf file g++ gcc libc-dev make pkg-config re2c'</font> (length=65)
'PHP_INI_DIR' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'/usr/local/etc/php'</font> (length=18)
'PHP_EXTRA_CONFIGURE_ARGS' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'--enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data'</font> (length=63)
'GPG_KEYS' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'1A4E8B7277C42E53DBA9C7B9BCAA30EA9C0D5763'</font> (length=40)
'PHP_VERSION' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'7.0.11'</font> (length=6)
'PHP_FILENAME' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'php-7.0.11.tar.xz'</font> (length=17)
'PHP_SHA256' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'d4cccea8da1d27c11b89386f8b8e95692ad3356610d571253d00ca67d524c735'</font> (length=64)
'HOME' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'/var/www'</font> (length=8)
'USER' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'www-data'</font> (length=8)
'HTTP_CONTENT_LENGTH' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'0'</font> (length=1)
'HTTP_ORIGIN' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'local.changemyworldnow.com'</font> (length=26)
'HTTP_USER_AGENT' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'HTTPie/0.9.3'</font> (length=12)
'HTTP_ACCEPT' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'/*'</font> (length=3)
'HTTP_ACCEPT_ENCODING' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'gzip, deflate'</font> (length=13)
'HTTP_CONNECTION' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'keep-alive'</font> (length=10)
'HTTP_HOST' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'api-local.changemyworldnow.com'</font> (length=30)
'REDIRECT_STATUS' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'200'</font> (length=3)
'HTTPS' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'on'</font> (length=2)
'SERVER_NAME' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'api-local.changemyworld.com'</font> (length=27)
'SERVER_PORT' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'443'</font> (length=3)
'SERVER_ADDR' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'172.18.0.5'</font> (length=10)
'REMOTE_PORT' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'53336'</font> (length=5)
'REMOTE_ADDR' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'172.18.0.1'</font> (length=10)
'SERVER_SOFTWARE' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'nginx/1.4.6'</font> (length=11)
'GATEWAY_INTERFACE' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'CGI/1.1'</font> (length=7)
'SERVER_PROTOCOL' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'HTTP/1.1'</font> (length=8)
'DOCUMENT_ROOT' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'/var/www/public'</font> (length=15)
'DOCUMENT_URI' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'/index.php'</font> (length=10)
'REQUEST_URI' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'/'</font> (length=1)
'SCRIPT_NAME' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'/index.php'</font> (length=10)
'CONTENT_LENGTH' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'0'</font> (length=1)
'CONTENT_TYPE' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>''</font> (length=0)
'REQUEST_METHOD' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'OPTIONS'</font> (length=7)
'QUERY_STRING' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>''</font> (length=0)
'SCRIPT_FILENAME' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'/var/www/public/index.php'</font> (length=25)
'FCGI_ROLE' <font color='#888a85'>=></font> <small>string</small> <font color='#cc0000'>'RESPONDER'</font> (length=9)

Here is the request that I make that contains multiple Set-Cookies:

http --verify=no OPTIONS https://api-local.changemyworldnow.com Origin:local.changemyworldnow.com

HTTP/1.1 200 OK
Allow: GET
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Wed, 08 Feb 2017 22:34:24 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: nginx
Set-Cookie: XDEBUG_SESSION=www-data; expires=Wed, 08-Feb-2017 23:34:20 GMT; Max-Age=3600; path=/
Set-Cookie: CMWN=4059bb7cf91b30aa690b315580203220; expires=Sat, 11-Feb-2017 22:34:23 GMT; Max-Age=259200; path=/; domain=.changemyworldnow.com; secure; HttpOnly
Set-Cookie: XSRF-TOKEN=e6c5941960e0a47a9ac2de8bf7a6b5cc-261485b068871d0eeb00a4a451aa0cec; Domain=.changemyworldnow.com; Path=/; Secure; HttpOnly
Set-Cookie: XDEBUG_SESSION=www-data; expires=Wed, 08-Feb-2017 23:34:24 GMT; Max-Age=3600; path=/
Set-Cookie: XDEBUG_SESSION=www-data; expires=Wed, 08-Feb-2017 23:34:24 GMT; Max-Age=3600; path=/
Set-Cookie: XDEBUG_SESSION=www-data; expires=Wed, 08-Feb-2017 23:34:24 GMT; Max-Age=3600; path=/
Set-Cookie: XDEBUG_SESSION=www-data; expires=Wed, 08-Feb-2017 23:34:24 GMT; Max-Age=3600; path=/
Set-Cookie: XDEBUG_SESSION=www-data; expires=Wed, 08-Feb-2017 23:34:24 GMT; Max-Age=3600; path=/
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-Powered-By: PHP/7.0.11

It might be something with the php-fpm working still wants to start an xdebug session consider this request that is not asking for an xdebug session to start:

http --headers --verify=no https://api-local.changemyworldnow.com/swagger
HTTP/1.1 500 Internal Server Error
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: application/problem+json
Date: Fri, 10 Feb 2017 16:26:26 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: nginx
Set-Cookie: XDEBUG_SESSION=www-data; expires=Fri, 10-Feb-2017 17:26:23 GMT; Max-Age=3600; path=/
Set-Cookie: CMWN=d1345e01a2bf9b48e414b34469034854; expires=Mon, 13-Feb-2017 16:26:25 GMT; Max-Age=259200; path=/; domain=.changemyworldnow.com; secure; HttpOnly
Transfer-Encoding: chunked
X-Powered-By: PHP/7.0.11

the httpie tool will not preserve multiple requests. Not sure why the Set-Cookie was was passed back on the second request

Is this still a problem? I've never been able to reproduce this. If you can still reproduce this, can you please provide a set of (simple) instructions for me to try to find the problem?

I'm marking this as resolved for now, as there is currently not enough information for me to go on. Let me know if you find further ways to try to reproduce this, and I'll have a look again.