eclipse-ee4j / eclipse-ee4j/jersey
Allow use of relative location headers
- Dominant language
- Java
- Stars
- 730
- Forks
- 382
- PR merge metrics
- No merged PRs in 30d
Description
# Description
In order to avoid issues with proxies (i.e. X-Forwarded-Port header being disabled by default on tomcat or the Forwarded header being ignored) servlets should be able to supply root-relative URLs for redirects without prior configuration.
# Cause
Due to [ServerRuntime.java#L416](https://github.com/eclipse-ee4j/jersey/blob/2.x/core-server/src/main/java/org/glassfish/jersey/server/ServerRuntime.java#L416) all location headers in responses will be rewritten from relative to abolsute URLs even when explicitly setting the header.
This breaks responses if they are behind proxies with configurations that aren't supported by tomcat by default.
# Suggestions
The code to rewrite relative to absolute URLs should be removed or disabled by default
# Reproduction example
```java
@Path("locationRelative")
public Response test(@Context UriInfo uriInfo) {
var location = uriInfo.getBaseUriBuilder()
.host(null)
.port(-1)
.scheme(null)
.build();
return Response
.status(Response.Status.TEMPORARY_REDIRECT)
.header("Location", location.toString())
.build();
}
```
Contributor guide
Research direction
Start with ServerRuntime.java around line 416 and reproduce the redirect using the relative Location header shown in the issue. Trace why the explicitly supplied root-relative URL is rewritten, then verify that the response preserves it without requiring proxy-header configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100