[
https://issues.apache.org/jira/browse/THRIFT-6362?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jens Geyer resolved THRIFT-6362.
--------------------------------
Fix Version/s: 0.26.0
Assignee: Jens Geyer
Resolution: Fixed
> PHP TCurlClient follows HTTP redirects to other origins
> -------------------------------------------------------
>
> Key: THRIFT-6362
> URL: https://issues.apache.org/jira/browse/THRIFT-6362
> Project: Thrift
> Issue Type: Bug
> Components: PHP - Library
> Reporter: Jens Geyer
> Assignee: Jens Geyer
> Priority: Minor
> Labels: Breaking-Change
> Fix For: 0.26.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> {{TCurlClient}} enables {{CURLOPT_FOLLOWLOCATION}} with {{CURLOPT_MAXREDIRS}}
> 1 on its shared curl handle, so it follows one redirect wherever the
> {{Location}} header points. The request, including the headers added through
> {{addHeaders()}} and, after a 307 or 308, its body, goes again to the scheme,
> host and port named there, and that server's reply is read as the response.
> After a 301, 302 or 303 the repeated request still carries the
> {{Content-Length}} that {{TCurlClient}} sets itself, although curl no longer
> sends the body, so the call waits for its timeout. {{THttpClient}} does not
> follow redirects.
> Proposed change: curl no longer follows redirects, and {{TCurlClient}}
> follows one itself, only within the origin of the configured URL, that is to
> the same scheme, host and port. It sends the request again, with its headers
> and body, to the path and query of the redirect target under the configured
> scheme, host and port. A redirect to another origin, including one from
> {{http}} to {{https}}, fails the request with a {{TTransportException}}, as
> any redirect does with {{THttpClient}}. The change is listed under the 0.26.0
> breaking changes in {{lib/php/README.md}}.
> Reported by Sylwester Lachiewicz.
> _Drafted with AI assistance (Claude Opus 5 and Claude Opus 5.5); reviewed and
> posted by Jens Geyer._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
