DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUGĀ·
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=41601>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED ANDĀ·
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=41601

           Summary: proxied redirects lose output headers
           Product: Apache httpd-2
           Version: 2.2.4
          Platform: Sun
        OS/Version: Solaris
            Status: NEW
          Severity: regression
          Priority: P2
         Component: mod_proxy
        AssignedTo: [email protected]
        ReportedBy: [EMAIL PROTECTED]


Problem: With Apache configured as a reverse HTTP proxy, when the backend server
returns a redirect, any output headers (other than Location) are getting lost. I
noticed and reproduced this with Set-Cookie but it applies to others too.

Cause: What's happening is that proxy_http_handler() in
modules/proxy/mod_proxy_http.c is returning an error state (ie: not OK or DONE)
to ap_process_request() in modules/http/http_request.c ap_invoke_handler (by way
of ap_invoke_handler/ap_run_handler). This causes ap_die() to be invoked, and
there the output headers are replaced with the error headers. The Location is
specifically kept. The body is also potentially stripped (though for most
redirects this is not an issue).

The bug seems to be that ap_proxy_http_process_response() - called within
proxy_http_handler() - is being too restrictive in what HTTP status code it
considers to be "not an error" when dealing with its error-override logic:

    if (conf->error_override) {
        /* the code above this checks for 'OK' which is what the hook expects */
        if (ap_is_HTTP_SUCCESS(r->status))
            return OK;
        else {
            // ... stripped some lines here for clarity
            return r->status;
        }
    } else
        return OK;

So if you have 'ProxyErrorOverride On', this will return OK if the status coming
from the backend server is >= 200 or < 300 only. Obviously redirects (which are
not errors) fall outside of this range.

Fix: the check here needs to also include redirect status codes. Ie: use
ap_is_HTTP_REDIRECT. There is a similar check futher up in the same function
which also needs ammending (that deals with passing the body through).

This bug is a regression in behaviour from the 2.0 branch (currently we run
2.0.58). Bug discovered and fix tested with 2.2.4 (will attach patch). Looking
at SVN, the current behaviour has been in the 2.2 branch since before 2.2.0, and
it is also in current trunk.

-- 
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Reply via email to