Skip to content

CXF-8746: Support forcing GET method on 301/302 redirects #2952

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gnodet wants to merge 1 commit into
base: main
Choose a base branch
from
+11 −0
Open

CXF-8746: Support forcing GET method on 301/302 redirects #2952

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,6 +205,7 @@ public abstract class HTTPConduit
private static final String AUTO_REDIRECT_ALLOW_REL_URI = "http.redirect.relative.uri";
private static final String AUTO_REDIRECT_ALLOWED_URI = "http.redirect.allowed.uri";
private static final String AUTO_REDIRECT_MAX_SAME_URI_COUNT = "http.redirect.max.same.uri.count";
private static final String AUTO_REDIRECT_FORCE_GET = "http.redirect.force.GET";

private static final String HTTP_POST_METHOD = "POST";
private static final String HTTP_GET_METHOD = "GET";
Expand Down Expand Up @@ -1546,6 +1547,16 @@ protected boolean redirectRetransmit() throws IOException {
if (newURL != null) {
new Headers(outMessage).removeAuthorizationHeaders();

// RFC 7231 Sections 6.4.2/6.4.3: For historical reasons, a user agent MAY
// change the request method from POST to GET for 301/302 redirects.
// This is enabled via the "http.redirect.force.GET" property.
int responseCode = getResponseCode();
if ((responseCode == HttpURLConnection.HTTP_MOVED_PERM
|| responseCode == HttpURLConnection.HTTP_MOVED_TEMP)
&& MessageUtils.getContextualBoolean(outMessage, AUTO_REDIRECT_FORCE_GET)) {
outMessage.put(Message.HTTP_REQUEST_METHOD, HTTP_GET_METHOD);
}

// If user configured this Conduit with preemptive authorization
// it is meant to make it to the end. (Too bad that information
// went to every URL along the way, but that's what the user
Expand Down