pjfanning opened a new pull request, #1463: URL: https://github.com/apache/poi/pull/1463
Follow-ups from the review of #1456 (https://github.com/apache/poi/pull/1456#issuecomment-6349998688), plus one more issue found while testing them. 1. **Overrides see the redirect hop.** The 4-arg `handleRedirect(String, MethodHandler, boolean, boolean sendAuth)` is now `protected` (`@since 6.0.1`); the 3-arg method still delegates to it. 2. **Default ports are normalized.** `https://h/` and `https://h:443/` are now the same origin, so credentials are no longer dropped needlessly. 3. **Relative `Location` headers work.** They are resolved against the request URL before being followed, and `isAuthForwardable` compares against the resolved URL. Previously, `/tsp2` failed with an `IOException`. 4. **JDK auto-follow is disabled.** `HttpURLConnection` follows same-protocol redirects (http→http, https→https, to any host) by default, so those hops never reached `handleRedirect`. They bypassed the `followRedirects` flag, the new credential check and any override. Only cross-protocol redirects (which the JDK refuses to follow) reached POI's code, which is why the #1456 https→http test passed. `setInstanceFollowRedirects(false)` is now set on every connection. **Behavior change:** with the default `followRedirects=false`, a same-protocol 3xx response is now returned as is (status code, `null` body) instead of being silently followed by the JDK. Callers that relied on that need `setFollowRedirects(true)`. Tests cover a relative same-origin redirect (resolved, routed through an override, credentials kept), a same-protocol redirect not followed by default, and default-port normalization in `isAuthForwardable`. The existing #1456 test now uses Hamcrest matchers for the header checks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
