transfer: Switch PUT to GET/HEAD on 303 redirect

[jay]

Prior to this change if there was a 303 reply to a PUT request then
the subsequent request to respond to that redirect would also be a PUT.
It was determined that was most likely incorrect based on the language
of the RFCs. Basically 303 means "see other" resource, which implies it
is most likely not the same resource, therefore we should not try to PUT
to that different resource.

Refer to the discussion in #5237 for more information.

Fixes #5237
Closes #xxxx

---

In Curl_http it will override the request string to PUT when data->set.upload is true, which is why I decided to fix this issue by setting data->set.upload as false on 303.

curl/lib/http.c

Lines 2070 to 2073 in b81e0b0

	if((conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_FTP)) &&
	data->set.upload) {
	httpreq = HTTPREQ_PUT;
	}

/cc @PofMagicfingers @jzakrzewski

[michael-o]

I'd like to hear the clarification of the HTTP WG before this gets merged.

[bagder]

I believe this change matches what the spirit of RFC 7231 section 6.4.4 seems to be. I do however think that this change also requires a test to verify it. I could only spot test 1332 when looking for existing tests using 303.

[jay]

@michael-o do you have an update? I would like to land this before the release next week.

[michael-o]

@jay I did not inquire anything with the HTTP WG. I expect this either you doing or @PofMagicfingers. I have just expressed my concerns.

[PofMagicfingers]

I did send an email to the http-wg mailing list a week ago, but as I'm not a member of their mailing list my message is pending manual processing. I've had no news about it and the question is not yet published :

https://lists.w3.org/Archives/Public/ietf-http-wg/2020AprJun/thread.html

[michael-o]

@PofMagicfingers You can also try the GitHub project of them. @reschke, can you help?

[reschke]

I would recommend to subscribe to the mailing list and re-post.

[PofMagicfingers]

@reschke Indeed. Reposted and it worked :
https://lists.w3.org/Archives/Public/ietf-http-wg/2020AprJun/0044.html

Thanks!

[PofMagicfingers]

We got an answer : https://lists.w3.org/Archives/Public/ietf-http-wg/2020AprJun/0046.html

The Location URL in a 303 is defined for retrieval. Only retrieval
methods can be expected to work on it.

HTTP defined GET and HEAD for regular use, but other protocols may
define more methods for retrieval. So there is no requirement to use
GET/HEAD specifically. Those other protocol alternatives may be used if
the context needs one.

Amos

[jay]

Thanks