[
https://issues.apache.org/jira/browse/SOLR-18343?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18111796#comment-18111796
]
ASF subversion and git services commented on SOLR-18343:
--------------------------------------------------------
Commit 1b437a844187c593362ea3c3d841e049179052c2 in solr's branch
refs/heads/branch_10x from Xinyao Zhang
[ https://gitbox.apache.org/repos/asf?p=solr.git;h=1b437a84418 ]
SOLR-18343: SolrJ now uses POST for suitable v1 admin requests (#4861)
SolrJ v1 admin requests now use appropriate HTTP verbs -- mostly POST, some GET.
Observability note: hurts since useful request params are no longer in the URL.
Addressing separately.
Backport note: deprecation should be: since = "10.1"
(cherry picked from commit 22620db37328e1f8794574daad661542ed0ab98d)
> SolrJ: require an explicit HTTP method on admin requests; stop defaulting to
> GET
> --------------------------------------------------------------------------------
>
> Key: SOLR-18343
> URL: https://issues.apache.org/jira/browse/SOLR-18343
> Project: Solr
> Issue Type: Improvement
> Components: SolrJ
> Reporter: David Smiley
> Priority: Major
> Labels: newdev, pull-request-available
> Time Spent: 1h 40m
> Remaining Estimate: 0h
>
> h2. Problem
> {{SolrRequest}} itself is fine — its single constructor requires a
> {{METHOD}}. The problem is one level down: the multi-action admin base
> classes hardcode GET, so none of their many subclasses ever states a verb.
> {code:java}
> // CollectionAdminRequest:87
> super(METHOD.GET, path, SolrRequestType.ADMIN);
> {code}
> The result is that CREATE, DELETE, SPLITSHARD, UNLOAD and the rest are all
> issued as HTTP GET. That is not defensible on HTTP grounds, and it misleads
> intermediaries — proxies and gateways are entitled to treat GET as safe, and
> some will retry it on a transient failure.
> h2. Proposal
> # *Require the verb.* Add {{METHOD}}-taking constructors to the admin base
> classes and deprecate the GET-defaulting ones, so each subclass is forced to
> think about it.
> # *Default macro handlers to POST.* For multi-action endpoints like
> {{/admin/collections}} and {{/admin/cores}}, POST is the safe default;
> actions known to be idempotent can specify GET explicitly.
> h3. Constructors that should change
> || Class || Line(s) || Note ||
> | {{CollectionAdminRequest}} | 87 | ~51 nested subclasses, 57 {{super(...)}}
> call sites |
> | {{CoreAdminRequest}} | 536, 540 | ~9 subclasses |
> | {{ConfigSetAdminRequest}} | 54, 58 | already has one POST override at
> {{:125}} for upload |
> h2. Scope
> Roughly three files. The ~66 subclass constructors that need a verb are all
> nested inside those same files, so it is a large diff in a small number of
> places rather than churn across the codebase. Repo-wide there are 255
> {{extends SolrRequest<}} declarations, but those already pass a verb
> explicitly and are unaffected.
> External impact is third-party subclasses of the three admin hierarchies,
> covered by a deprecation cycle.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
