----- Original Message ----- From: "Remy Maucherat" <[EMAIL PROTECTED]> To: "Tomcat Developers List" <[EMAIL PROTECTED]> Sent: Tuesday, December 02, 2003 8:59 AM Subject: Re: cvs commit: jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11 Http11Processor.java
> [EMAIL PROTECTED] wrote: > > > jfarcand 2003/12/02 08:27:11 > > > > Modified: coyote/src/java/org/apache/coyote Request.java > > ActionCode.java catalina/src/share/org/apache/coyote/tomcat5 > > CoyoteRequest.java http11/src/java/org/apache/coyote/http11 > > Http11Processor.java Log: Implement getLocalPort using ActionCode > > instead of getServerPort. Associate 1 ActionCode for each getXXX > > method. > > > > Please review. > > I'll have to vote -0 for implementing getLocalPort as mandated in the > specification, since I think this is a huge mistake, and the spec > authors intention is misinterpreted (or they didn't think about all the > consequences of the wording they used, thinking only about the case of a > server without any proxies, or using an AJP-like scheme). BTW, I also > think your patch has a sky high likelihood of breaking the JK 2 > connector ;-) > > I said it would be ok, yesterday, but I changed my mind, as this looks > wrong. > If Bill votes -1 to this, I'll change my vote to -1. I'm fine with the patch (although not a great fan of getLocalPort :). > > The problem is that this call is likely intended to allow users to build > URLs to the server. Actually, this won't work, since the server may not > be accessible with the connector hostname or port. What actually should > be returned is what is in the Host header (HTTP/1.0 is a broken > spec, since it can't possibly work when behind a reverse proxy). > Otherwise, we're returning completely useless information to the user, > and the getLocalPort is simply useless. Users should be using getServerPort to build URLs to the server. The problem with yesterdays patch is that it broke getServerPort (which is defined to be the value of the Host header). I agree that getLocalPort is simply useless, but it's in the spec so we have to implement it :). About the only thing that it is good for is to grant rights to requests coming in on one connector, but not on another (which points to a bad design). > > Note: Compliant HTTP/1.1 clients must send correct Host header, and > proxy servers are not allowed to modify them. > > Rémy > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [EMAIL PROTECTED] > For additional commands, e-mail: [EMAIL PROTECTED] >
This message is intended only for the use of the person(s) listed above as the intended recipient(s), and may contain information that is PRIVILEGED and CONFIDENTIAL. If you are not an intended recipient, you may not read, copy, or distribute this message or any attachment. If you received this communication in error, please notify us immediately by e-mail and then delete all copies of this message and any attachments. In addition you should be aware that ordinary (unencrypted) e-mail sent through the Internet is not secure. Do not send confidential or sensitive information, such as social security numbers, account numbers, personal identification numbers and passwords, to us via ordinary (unencrypted) e-mail.
--------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
