You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In order to avoid issues with proxies (i.e. X-Forwarded-Port header being disabled by default on tomcat or the Forwarded header being ignored) servlets should be able to supply root-relative URLs for redirects without prior configuration.
Cause
Due to ServerRuntime.java#L416 all location headers in responses will be rewritten from relative to abolsute URLs even when explicitly setting the header.
This breaks responses if they are behind proxies with configurations that aren't supported by tomcat by default.
Suggestions
The code to rewrite relative to absolute URLs should be removed or disabled by default
We should be aware of some compatibility. While the Jakarta REST Spec still refers to RFC 2616, at the same time, it refers to the Servlet Spec 4.0, which mentions RFC 7231. However, JAX-RS Spec 2.1 refers only Servlet 2.5 Spec, Servlet 4.0 is referred by Jakarta REST 3.0 earliest.
As a conclusion, the change should not go into Jersey 2.x, at least not by default.
Starting with Jersey 3.0, the change can be done, but it is a behavior change. I am not inclined to introduce a behaviour change in Jersey, especially in pre-3.1 Jersey.
Hence, Jersey 3.1 branch should be targeted by this request for a start.
Description
In order to avoid issues with proxies (i.e. X-Forwarded-Port header being disabled by default on tomcat or the Forwarded header being ignored) servlets should be able to supply root-relative URLs for redirects without prior configuration.
Cause
Due to ServerRuntime.java#L416 all location headers in responses will be rewritten from relative to abolsute URLs even when explicitly setting the header.
This breaks responses if they are behind proxies with configurations that aren't supported by tomcat by default.
Suggestions
The code to rewrite relative to absolute URLs should be removed or disabled by default
Reproduction example
The text was updated successfully, but these errors were encountered: