-
Notifications
You must be signed in to change notification settings - Fork 17.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
net/http: Redirect conditions are incorrect, support 307/308 #10767
Comments
Too late for Go 1.5. See also #9348. |
This document has been superseded by https://tools.ietf.org/html/rfc7231#section-6.4 |
|
It seems Go doesn't have a constant for 308, and explicitly does not consider it for redirects. This led to unexpected behaviour for someone using a program implemented in Go. I can't find a technical reason this is not supported; is it just a matter of making Go know about 308's? |
@lgarron, the constant was added during the Go 1.7 dev cycle. You can see it at https://tip.golang.org/pkg/net/http/#pkg-constants It seems that 308 should be followed. |
Ah, excellent! I didn't know about |
CL https://golang.org/cl/29852 mentions this issue. |
CL https://golang.org/cl/31733 mentions this issue. |
Updates #10767 Change-Id: I197535f71bc2dc45e783f38d8031aa717d50fd80 Reviewed-on: https://go-review.googlesource.com/31733 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
CL https://golang.org/cl/32595 mentions this issue. |
This CL tweaks the new (unreleased) 307/308 support added in https://golang.org/cl/29852 for #10767. Change 1: if a 307/308 response doesn't have a Location header in its response (as observed in the wild in #17773), just do what we used to do in Go 1.7 and earlier, and don't try to follow that redirect. Change 2: don't follow a 307/308 if we sent a body on the first request and the caller's Request.GetBody func is nil so we can't "rewind" the body to send it again. Updates #17773 (will be fixed more elsewhere) Change-Id: I183570f7346917828a4b6f7f1773094122a30406 Reviewed-on: https://go-review.googlesource.com/32595 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
I believe the functions Client.doFollowingRedirects and shouldRedirect{Post,Get} are incorrect according to http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html. Of the 4 redirect codes considered in this code, 301, 302, and 307 should redirect for GET and HEAD only. 303 should always redirect, and always convert the method to GET.
Currently 302 and 303 are redirecting POST and PUT, and converting to GET in doing so. I doubt anyone is relying on the current broken behaviour as it doesn't work as expected for due to #3665, which prematurely consumes the original request body when using POST/PUT in a safe way.
The text was updated successfully, but these errors were encountered: