-
Notifications
You must be signed in to change notification settings - Fork 2.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fixed Responses to OPTIONS Requests ignore Body #15108
base: main
Are you sure you want to change the base?
Conversation
…g/en-US/docs/Web/HTTP/Methods/CONNECT Response to OPTIONS may contain response body Request CONNECT must not contain body Sorted removing alphabetically by METHOD NAME
Im not sure if these simple changes needs new tests. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We should follow the spec and add tests for it if anything is changed
https://datatracker.ietf.org/doc/html/rfc7231#section-4.3.1
A payload within a GET request message has no defined semantics;
sending a payload body on a GET request might cause some existing
implementations to reject the request.
for CONNECT we need more work:
CONNECT is intended only for use in requests to a proxy. An origin
server that receives a CONNECT request for itself MAY respond with a
2xx (Successful) status code to indicate that a connection is
established. However, most origin servers do not implement CONNECT.
A server MUST NOT send any Transfer-Encoding or Content-Length header
fields in a 2xx (Successful) response to CONNECT. A client MUST
ignore any Content-Length or Transfer-Encoding header fields received
in a successful response to CONNECT.
A payload within a CONNECT request message has no defined semantics;
sending a payload body on a CONNECT request might cause some existing
implementations to reject the request.
for OPTIONS we also need more checks:
A client that generates an OPTIONS request containing a payload body
MUST send a valid Content-Type header field describing the
representation media type. Although this specification does not
define any use for such a payload, future extensions to HTTP might
use the OPTIONS body to make more detailed queries about the target
resource.
shall I remove the .CONNECT Change for simpleness of this PR to fix the existing bug and address the OPTIONS request body later? |
You can reduce the context to only change the EDIT: I meant OPTIONS sorry |
The current bug is, that Responses to OPTIONS have no body in bun, even though the server sends it. So I would reduce the changes, to allow OPTIONS Responses to have body and add a test for this. So we can close this bug. I'd address the OPTIONS Requests with Body in a later PR. |
Sure I meant OPTIONS sorry, you can reduce the context for only 1 change at a time sure, we still will need the tests. |
Fixes #15082
Rules for containing body didnt align to Docs