Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow use of relative location headers #5817

Open
spthiel opened this issue Dec 10, 2024 · 1 comment
Open

Allow use of relative location headers #5817

spthiel opened this issue Dec 10, 2024 · 1 comment
Labels
enhancement New feature or request

Comments

@spthiel
Copy link

spthiel commented Dec 10, 2024

Description

In order to avoid issues with proxies (i.e. X-Forwarded-Port header being disabled by default on tomcat or the Forwarded header being ignored) servlets should be able to supply root-relative URLs for redirects without prior configuration.

Cause

Due to ServerRuntime.java#L416 all location headers in responses will be rewritten from relative to abolsute URLs even when explicitly setting the header.
This breaks responses if they are behind proxies with configurations that aren't supported by tomcat by default.

Suggestions

The code to rewrite relative to absolute URLs should be removed or disabled by default

Reproduction example

@Path("locationRelative")
public Response test(@Context UriInfo uriInfo) {
    var location = uriInfo.getBaseUriBuilder()
                          .host(null)
                          .port(-1)
                          .scheme(null)
                          .build();

    return Response
                .status(Response.Status.TEMPORARY_REDIRECT)
                .header("Location", location.toString())
                .build();
}
@jansupol
Copy link
Contributor

jansupol commented Dec 10, 2024

HTTP 1.1 RFC 2616 allowed only an absolute URI as a location.
RFC 9110 allows for a relative URI.
The change came in RFC 7231.

We should be aware of some compatibility. While the Jakarta REST Spec still refers to RFC 2616, at the same time, it refers to the Servlet Spec 4.0, which mentions RFC 7231. However, JAX-RS Spec 2.1 refers only Servlet 2.5 Spec, Servlet 4.0 is referred by Jakarta REST 3.0 earliest.

As a conclusion, the change should not go into Jersey 2.x, at least not by default.
Starting with Jersey 3.0, the change can be done, but it is a behavior change. I am not inclined to introduce a behaviour change in Jersey, especially in pre-3.1 Jersey.

Hence, Jersey 3.1 branch should be targeted by this request for a start.

@jansupol jansupol added the enhancement New feature or request label Dec 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants