HttpServletResponse.sendRedirect(String location) builds absolute URL including protocol and server-name

[christophs78]

Describe the bug
Doing response.sendRedirect("/frw-demo/index.xhtml") creates the follwing response on OpenLiberty 19.0.0.6:

Steps to Reproduce
response.sendRedirect("/frw-demo/index.xhtml")

Expected behavior
Apache Tomcat 9 does the following:

Diagnostic information:

• OpenLiberty Version: 19.0.0.6
• Java Version: OpenJDK 64-Bit Server VM, version 1.8.0_163-b01 (en_AT)

Additional context
This causes troubles behind some Reverse-Proxies.

Think the issue is related to https://github.com/OpenLiberty/open-liberty/blob/master/dev/com.ibm.ws.webcontainer/src/com/ibm/ws/webcontainer/webapp/WebAppDispatcherContext.java method convertRelativeURIToURL.

Let´s compare this to the Tomcat-implementation:
https://github.com/apache/tomcat/blob/master/java/org/apache/catalina/connector/Response.java method sendRedirect

I also did some Google-Research and https://stackoverflow.com/questions/8250259/is-a-302-redirect-to-relative-url-valid-or-invalid tells us relative redirects are allowed.

From my view the Tomcat-behaviour is the right one. Or maybe a system-property should be introduced to make this behaviour configurable.
There´s already code like
if (com.ibm.ws.webcontainer.util.WebContainerSystemProps.getSendRedirectCompatibilty())

[wtlucy]

The servlet sendRedirect spec is pretty clear here: the servlet container must convert the relative URL to an absolute URL before sending the response to the client. So the behavior Liberty has here looks correct, but we can explore the utility of making this configurable.

[christophs78]

The servlet-spec was written at a point in time when absolute URLs were mandatory.

Maybe no one has updated it since:

RFC 2616 requires an absolute URI in the Location, but that standard has been replaced, since June 2014. The relevant specification is now RFC 7231.

Making this behaviour configurable would be a good move in my opinion.

[wtlucy]

@pmd1nh has opened a servlet spec issue to get clarification for this behavior.

[pnicolucci]

@pmd1nh can this one be closed now that the PR you worked is integrated?

[pmd1nh]

blog issue #15605