Jens-G opened a new pull request, #3933:
URL: https://github.com/apache/thrift/pull/3933
`TCurlClient` let curl follow one redirect wherever the `Location` header
pointed. The request, including the headers added with `addHeaders()` and,
after a 307 or 308, its body, went to that scheme, host and port, and that
server's reply was read as the response. After a 301, 302 or 303 the repeated
request kept the `Content-Length` that `TCurlClient` sets, although curl sent
no body, so the call waited for its timeout.
With this change curl no longer follows redirects. `flush()` follows one
itself, and only when it stays within the origin of the configured URL, that is
the same scheme, host and port:
- The request goes out again, with its headers and body, to the path and
query of the redirect target under the configured scheme, host and port. The
URL is rebuilt from those parts; the `Location` string itself never reaches
curl.
- A redirect to another origin, a second redirect, or a 3xx without a usable
`Location` fails the request with a `TTransportException`, as any redirect does
with `THttpClient`.
**Breaking change:** a redirect to another origin, including one from `http`
to `https`, now fails. Configure the client with the scheme, host and port that
serve the requests. `lib/php/README.md` lists it under 0.26.0.
### How it was checked
- The new `TCurlClientRedirectTest` (Integration suite) runs `TCurlClient`
against two listeners on 127.0.0.1, served by a forked child; listener B, on
another port, is another origin.
- On master, a 307 from A to B delivers `X-Api-Key` and the body to B, and
B's reply is accepted; a 302 from A to B delivers the header and then waits for
its 2 s timeout; a 302 within A times out as well.
- With this change B gets no connection at all, and a 302 or 307 within A
is followed, with the headers and the body sent again.
- `TCurlClientTest`: the expected option sequences, and 12 new cases for the
origin comparison: host in another case, explicit default ports, https on 443,
a user name in the URL, a second redirect, and a 3xx without a `Location`.
- PHP 8.4.25 and PHP 8.2.33: the 35 `TCurlClient` tests pass; the full suite
runs 975 tests with no failures; phpcs and phpstan are clean.
A followed redirect gets its own `CURLOPT_TIMEOUT` window, so a redirected
call can take up to twice the configured timeout.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
