[
https://issues.apache.org/jira/browse/CXF-8752?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17597591#comment-17597591
]
Yves Piel commented on CXF-8752:
--------------------------------
Not sure to know how to create a unit test.
Indeed, in HTTPConduitURLEasyMockTest 'POST' is already used to test
redirection. It works because the test in
[handleRetransmits()|https://github.com/apache/cxf/blob/d4e50c4167cdf2e06972ad90e507ef9423d00664/rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java#L1431]
first check if 'cachedStream' is null or not. If not null, the list of verbs
is not checked.
When I use the cxf library, 'cachedStream' is null on my side, but when it is
called from
[HTTPConduitURLEasyMockTest#testSendHttpConnectionAutoRedirect|https://github.com/apache/cxf/blob/d4e50c4167cdf2e06972ad90e507ef9423d00664/rt/transports/http/src/test/java/org/apache/cxf/transport/http/HTTPConduitURLEasyMockTest.java#L206]
'cachedStream' is not null and so 'POST' rediection is accepted.
Any idea [~reta] ?
> Configurable list of redirectable verbs
> ---------------------------------------
>
> Key: CXF-8752
> URL: https://issues.apache.org/jira/browse/CXF-8752
> Project: CXF
> Issue Type: New Feature
> Affects Versions: 3.5.3, 3.4.8
> Reporter: Yves Piel
> Priority: Major
> Fix For: 4.0.0, 3.6.0, 3.5.4, 3.4.9
>
> Attachments: image-2022-08-18-10-57-00-592.png,
> image-2022-08-18-10-57-24-093.png
>
>
> Currently, redirections are limited to 'verbs with no content':
> * [List of verbs with no
> content|https://github.com/apache/cxf/blob/4e110842a36ac1923870df2c4b9f1a3266dfbc80/rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java#L202]
> * [Limitation for
> redirections|https://github.com/apache/cxf/blob/4e110842a36ac1923870df2c4b9f1a3266dfbc80/rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java#L1432]
> In [HTTP/1.1 specification|https://www.rfc-editor.org/rfc/rfc7231.html] it is
> written that automatic redirection need to be done with care for methods not
> known to be safe:
> !image-2022-08-18-10-57-24-093.png|width=477,height=122!
> The safe methods are GET, HEAD, OPTIONS, and TRACE, those listed in [list of
> verbs with no
> content|https://github.com/apache/cxf/blob/4e110842a36ac1923870df2c4b9f1a3266dfbc80/rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java#L202]
> .
> !image-2022-08-18-10-57-00-592.png|width=394,height=302!
> Although the specification tells to do redirection of not safe method with
> care, it doesn't forbid it. Currently, it is not possible to do redirection
> of a POST method with CXF.
>
> Maybe it could be acceptable to configure the list of redirected verbs ?
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
