Http POST request should follow 302 redirects

[yizhepku]

Currently, POST doesn't follow redirects even when followRedirects is set to True. This can be quite surprising for users. See dart-lang/http#157 .
A promising solution is to make followRedirects default to false when using POST and other methods, but still allows user to override this behavior.
The python requests library does this and it seems to work well.

[natebosch]

302 is not considered a redirect for 'POST'` request. This is defined by the SDK on the vm here:

sdk/sdk/lib/_http/http_impl.dart

Lines 355 to 365 in f8f0b84

	bool get isRedirect {
	if (_httpRequest.method == "GET" || _httpRequest.method == "HEAD") {
	return statusCode == HttpStatus.movedPermanently ||
	statusCode == HttpStatus.found ||
	statusCode == HttpStatus.seeOther ||
	statusCode == HttpStatus.temporaryRedirect;
	} else if (_httpRequest.method == "POST") {
	return statusCode == HttpStatus.seeOther;
	}
	return false;
	}

For a 'POST' request you can redirect with a 307 status. The spec specifically tells us not to redirect for requests other than 'GET' or 'HEAD'

https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3.3

[yizhepku]

RFC 2616 says

If the 302 status code is received in response to a request other than GET or HEAD, the user agent MUST NOT automatically redirect the request unless it can be confirmed by the user.

In our case, if a user writes http.post(url, followRedirect=true), this can pretty much be treated as "confirmed by the user" since the user knows beforehand that his POST request will probably get redirected.

There is also a note in section 10.3.3:

Note: RFC 1945 and RFC 2068 specify that the client is not allowed to change the method on the redirected request. However, most existing user agent implementations treat 302 as if it were a 303 response, performing a GET on the Location field-value regardless of the original request method. The status codes 303 and 307 have been added for servers that wish to make unambiguously clear which kind of reaction is expected of the client.

With RFC 7231(which obsoletes 2616), the requirement that user-agents should notify users has been dropped, which means many broswers redirect POST requests when receiving a 302 anyway.

Note: For historical reasons, a user agent MAY change the request method from POST to GET for the subsequent request. If this behavior is undesired, the 307 (Temporary Redirect) status code can be used instead.

It will be nice to implement the least surprising behavior and redirect when the user explicitly asks us to.

[natebosch]

if a user writes

I suspect that an application author is not the "user" as discussed in the RFC, even if they might be considered the "user" of the Dart SDK.

the requirement that user-agents should notify users has been dropped, which means many broswers redirect POST requests when receiving a 302 anyway.

I've moved the issue to the SDK repo for further discussion.

[HiteshMoorjaniX]

I had the same issue. while looking carefully I missed the content type in the header parameters.
header : "Accept" : "application/json" .
If I do not provide header parameter it was giving me 302 error.
Thanks