Make 303 redirects do GET like Net Framework #49095

TimothyByrd · 2021-03-04T00:08:52Z

Make 303 redirects do GET like Net Framework

In Net Framework, PUT redirects on a 303 do a GET.
Net 5.0 breaks compatibility with this.
See #28998
This commit causes redirects of a 303 to do a GET
for POST (existing behavior), PUT, DELETE, PATCH and OPTIONS

Fix #28998

…m to net Framework behaviour - issue 28998

In Net Framework, PUT redirects do a GET. Net 5.0 breaks compatibiltiy with this. See #28998 This commit causes PUT redirects to act like POST redirects for 30x responses to conform to Net Framework behaviour. Fix #28998

…untime into issue/28998

ghost · 2021-03-04T00:08:57Z

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Issue Details

Make PUT redirects do GET like Net Framework

In Net Framework, PUT redirects do a GET.
Net 5.0 breaks compatibility with this.
See #28998
This commit causes PUT redirects to act like POST redirects
for 30x responses to conform to Net Framework behavior.

Fix #28998

Author:	TimothyByrd
Assignees:	-
Labels:	`area-System.Net.Http`
Milestone:	-

dnfadmin · 2021-03-04T00:09:08Z

All CLA requirements met.

…untime into issue/28998

geoffkizer · 2021-03-04T09:23:07Z

I think we need to have consensus on what the right behavior here is in #28998 before we can consider taking this PR.

I'll add my comments there shortly.

In Net Framework, PUT redirects on a 303 do a GET. Net 5.0 breaks compatibility with this. See #28998 This commit causes redirects of a 303 to do a GET for POST (existing behaviour), PUT, DELETE, PATCH and OPTIONS Fix #28998

In Net Framework, PUT redirects on a 303 do a GET. Net 5.0 breaks compatibility with this. See #28998 This commit causes redirects of a 303 to do a GET for all methods except HEAD. Fix #28998

wfurt · 2021-03-07T22:40:28Z

You should add tests covering code changes @TimothyByrd. I agree with @geoffkizer that we should reach consensus on #28998 first.

TimothyByrd · 2021-03-08T00:04:02Z

@wfurt

You should add tests covering code changes @TimothyByrd. I agree with @geoffkizer that we should reach consensus on #28998 first.

I did. They are in src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.AutoRedirect.cs

geoffkizer · 2021-03-08T23:48:52Z

src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.AutoRedirect.cs

+                yield return new object[] { statusCode, "PUT", statusCode == 303 ? "GET" : "PUT" };
+                yield return new object[] { statusCode, "DELETE", statusCode == 303 ? "GET" : "DELETE" };
+                yield return new object[] { statusCode, "PATCH", statusCode == 303 ? "GET" : "PATCH" };
+                yield return new object[] { statusCode, "OPTIONS", statusCode == 303 ? "GET" : "OPTIONS" };


The one thing I'd add here is a completely custom method, e.g. "MYCUSTOMMETHOD" or whatever, and validate it gets changed to GET on 303.

Done - first i verified that an incorrect test of
yield return new object[] { statusCode, "MYCUSTOMMETHOD", "MYCUSTOMMETHOD" };
fails and then that the correct
yield return new object[] { statusCode, "MYCUSTOMMETHOD", statusCode == 303 ? "GET" : "MYCUSTOMMETHOD" };
passes
(I like breaking tests so I can tell I did something when I make them work)

geoffkizer · 2021-03-08T23:50:41Z

Overall this looks good, just one comment to add an addition test case above.

Fix #28998

geoffkizer · 2021-03-09T18:24:22Z

src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/RedirectHandler.cs

                case HttpStatusCode.MultipleChoices:
                    return requestMethod == HttpMethod.Post;
+                case HttpStatusCode.SeeOther:
+                    return requestMethod != HttpMethod.Head;


One more nit: I think this should return false when requestMethod == HttpMethod.Get.

It probably doesn't make much difference, but it seems better to treat this as not changing the method, as we do with GET in other cases like Moved. If nothing else, it will avoid an unnecessary and confusing trace call.

Okay - done.

Fix #28998

geoffkizer · 2021-03-09T19:42:29Z

/azp run runtime-libraries-coreclr outerloop

azure-pipelines · 2021-03-09T19:42:42Z

Azure Pipelines successfully started running 1 pipeline(s).

geoffkizer · 2021-03-09T23:27:53Z

CI failures look unrelated, will merge

geoffkizer · 2021-03-09T23:29:19Z

Thanks for your contribution, @TimothyByrd!

* upstream/main: (83 commits) Fix a crash in llvm if the sreg of a setret is not set because the methods ends with a throw. (dotnet#49122) [macOS-arm64] Disable failing libraries tests (dotnet#49400) improve PriorityQueue documentation (dotnet#49392) [wasm] Fix debugger tests (dotnet#49206) [mono] Fix the emission of EnumEqualityComparer instances into the corlib AOT image. (dotnet#49402) jitutils M2M renaming reaction (dotnet#49430) WinHttpHandler: Read HTTP/2 trailing headers [RyuJIT] Make casthelpers cold for sealed classes (dotnet#49295) JIT: Non-void ThrowHelpers (dotnet#48589) Update package index for servicing (dotnet#49417) Remove unnecessary check on polymorphic serialization (dotnet#48464) Remove release build cron triggers from jitstress jobs (dotnet#49333) [main] Update dependencies from dotnet/arcade dotnet/llvm-project dotnet/runtime-assets (dotnet#49359) Implement AppleCryptoNative_X509GetRawData using SecCertificateCopyData [AndroidCrypto] Support a zero-length salt for HMACs. (dotnet#49384) Use managed implementation of pbkdf2 for Android's one-shot implementation. (dotnet#49314) Make 303 redirects do GET like Net Framework (dotnet#49095) Make sure event generation is incremental (dotnet#48903) Add amd and Surface arm64 perf runs (dotnet#49389) Enregister EH var that are single def (dotnet#47307) ...

Timothy Byrd added 4 commits March 3, 2021 15:48

make PUT redirects act like POST redirects for 30x reponses to confor…

73c3f7f

…m to net Framework behaviour - issue 28998

Make PUT redirects do GET like Net Framework

8dafbc8

In Net Framework, PUT redirects do a GET. Net 5.0 breaks compatibiltiy with this. See #28998 This commit causes PUT redirects to act like POST redirects for 30x responses to conform to Net Framework behaviour. Fix #28998

Merge branch 'issue/28998' of https://github.com/TimothyByrd/dotnet_r…

d5c8555

…untime into issue/28998

Merge branch 'issue/28998' of https://github.com/TimothyByrd/dotnet_r…

7adca75

…untime into issue/28998

dotnet-issue-labeler bot added the area-System.Net.Http label Mar 4, 2021

Merge branch 'issue/28998' of https://github.com/TimothyByrd/dotnet_r…

2717413

…untime into issue/28998

karelz added the blocked Issue/PR is blocked on something - see comments label Mar 4, 2021

Make 303 redirects do GET like Net Framework

66f59c4

In Net Framework, PUT redirects on a 303 do a GET. Net 5.0 breaks compatibility with this. See #28998 This commit causes redirects of a 303 to do a GET for POST (existing behaviour), PUT, DELETE, PATCH and OPTIONS Fix #28998

TimothyByrd changed the title ~~Make PUT redirects do GET like Net Framework~~ Make 303 redirects do GET like Net Framework Mar 4, 2021

Make 303 redirects do GET like Net Framework

98b4652

In Net Framework, PUT redirects on a 303 do a GET. Net 5.0 breaks compatibility with this. See #28998 This commit causes redirects of a 303 to do a GET for all methods except HEAD. Fix #28998

geoffkizer reviewed Mar 8, 2021

View reviewed changes

Timothy Byrd added 2 commits March 8, 2021 20:22

Add test for MYCUSTOMMETHOD to check 303 redirect

ca834c0

Fix #28998

Group test code by behavior

3ec922c

Fix #28998

geoffkizer reviewed Mar 9, 2021

View reviewed changes

Do not change GET to GET on 303

728a81f

Fix #28998

geoffkizer approved these changes Mar 9, 2021

View reviewed changes

geoffkizer merged commit 0ab99ce into dotnet:main Mar 9, 2021

runfoapp bot mentioned this pull request Mar 12, 2021

Test failure: System.Security.Cryptography.X509Certificates.Tests.CertificateCreation.CertificateRequestChainTests/CreateChain_Hybrid #25979

Closed

runfoapp bot mentioned this pull request Mar 22, 2021

System.Security.Cryptography.X509Certificates.Tests.ChainTests.BuildInvalidSignatureTwice #48851

Closed

ghost locked as resolved and limited conversation to collaborators Apr 9, 2021

karelz added this to the 6.0.0 milestone May 20, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Make 303 redirects do GET like Net Framework #49095

Make 303 redirects do GET like Net Framework #49095

TimothyByrd commented Mar 4, 2021 •

edited

Loading

ghost commented Mar 4, 2021

dnfadmin commented Mar 4, 2021 •

edited

Loading

geoffkizer commented Mar 4, 2021

wfurt commented Mar 7, 2021

TimothyByrd commented Mar 8, 2021 •

edited

Loading

geoffkizer Mar 8, 2021

TimothyByrd Mar 9, 2021 •

edited

Loading

geoffkizer commented Mar 8, 2021

geoffkizer Mar 9, 2021

TimothyByrd Mar 9, 2021

geoffkizer commented Mar 9, 2021

azure-pipelines bot commented Mar 9, 2021

geoffkizer commented Mar 9, 2021

geoffkizer commented Mar 9, 2021

Make 303 redirects do GET like Net Framework #49095

Make 303 redirects do GET like Net Framework #49095

Conversation

TimothyByrd commented Mar 4, 2021 • edited Loading

ghost commented Mar 4, 2021

dnfadmin commented Mar 4, 2021 • edited Loading

geoffkizer commented Mar 4, 2021

wfurt commented Mar 7, 2021

TimothyByrd commented Mar 8, 2021 • edited Loading

geoffkizer Mar 8, 2021

Choose a reason for hiding this comment

TimothyByrd Mar 9, 2021 • edited Loading

Choose a reason for hiding this comment

geoffkizer commented Mar 8, 2021

geoffkizer Mar 9, 2021

Choose a reason for hiding this comment

TimothyByrd Mar 9, 2021

Choose a reason for hiding this comment

geoffkizer commented Mar 9, 2021

azure-pipelines bot commented Mar 9, 2021

geoffkizer commented Mar 9, 2021

geoffkizer commented Mar 9, 2021

TimothyByrd commented Mar 4, 2021 •

edited

Loading

dnfadmin commented Mar 4, 2021 •

edited

Loading

TimothyByrd commented Mar 8, 2021 •

edited

Loading

TimothyByrd Mar 9, 2021 •

edited

Loading