eclipse-ee4j / eclipse-ee4j/jersey

Allow use of relative location headers

Open
#5,817 1 comment 3 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
730
Forks
382
PR merge metrics
No merged PRs in 30d

Description

# Description
In order to avoid issues with proxies (i.e. X-Forwarded-Port header being disabled by default on tomcat or the Forwarded header being ignored) servlets should be able to supply root-relative URLs for redirects without prior configuration.

# Cause

Due to [ServerRuntime.java#L416](https://github.com/eclipse-ee4j/jersey/blob/2.x/core-server/src/main/java/org/glassfish/jersey/server/ServerRuntime.java#L416) all location headers in responses will be rewritten from relative to abolsute URLs even when explicitly setting the header.
This breaks responses if they are behind proxies with configurations that aren't supported by tomcat by default.

# Suggestions

The code to rewrite relative to absolute URLs should be removed or disabled by default

# Reproduction example

```java
@Path("locationRelative")
public Response test(@Context UriInfo uriInfo) {
var location = uriInfo.getBaseUriBuilder()
.host(null)
.port(-1)
.scheme(null)
.build();

return Response
.status(Response.Status.TEMPORARY_REDIRECT)
.header("Location", location.toString())
.build();
}
```

Contributor guide

Open the contributing guide

Research direction

Start with ServerRuntime.java around line 416 and reproduce the redirect using the relative Location header shown in the issue. Trace why the explicitly supplied root-relative URL is rewritten, then verify that the response preserves it without requiring proxy-header configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.