Re: [jetty-users] Possible bug in 9.4 HttpServletResponse redirect?

[Silvio Bierman <sbierman@xxxxxxxxxxxxxxxxxx>]

On 01/05/2017 07:53 PM, Simone Bordet wrote:
> Hi,
>
> On Thu, Jan 5, 2017 at 4:14 PM, Silvio Bierman
> <sbierman@xxxxxxxxxxxxxxxxxx> wrote:
> > Hello all,
> >
> > With Jetty 9.4 I experience failure of some code that used to work with
> > previous Jetty versions. But since I am unsure if my code is valid I want to
> > check here first.
> >
> > My code is supposed to proxy an incoming request by forwarding it to another
> > server (using HttpURLConnection) and then pass back the result to the
> > response. In pseudo-code and somewhat simplified it does something like:
> >
> > - forward all headers from HttpServletRequest#getHeaderNames +
> > HttpServletRequest#getHeaders via HttpURLConnection#addRequestProperty
> > - forward request body from HttpServletRequest#getInputStream to
> > HttpURLConnection#getOutputStream
> > - pass back all headers from HttpURLConnection#getHeaderFields to
> > HttpServletResponse#addHeader
> > - pass back response body from HttpURLConnection#getInputStream to
> > HttpServletResponse#getOutputStream
> > - HttpServletResponse#sendError(HttpURLConnection#getResponseCode)
> Oh wow !
>
> You cannot do that, and I'm surprised it even worked in Jetty 9.3 - it
> probably only does because the content is small.
>
> You want to set the response code *before* writing any content via
> HttpServletResponse#setStatus().
>
> The reason it does not work in 9.4.x is that we have cleaned up the
> way we handle errors, that was pretty broken in 9.3.x (so I guess your
> code was working because of a Jetty 9.3.x bug).
>
> Have you considered using one of the many Jetty ProxyServlets, or at
> least HttpClient instead of HttpURLConnection ?

Simone,

Thank you for the info. Sounds plausible, I will fix that. So 
sendRedirect clears everything, sets the status and then then Location 
header, I guess.

Yes, I have considered alternatives. But this is part of some inherited 
legacy code which I would prefer to change as little as possible. In 
fact, this has worked since the days of Jetty 4 so it as never under any 
suspicion.

Thanks again,

Cheers,

Silvio