Support Relative URIs in Location Header
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 327
- Forks
- 112
- Avg merge
- 4h 2m
- Merged PRs (30d)
- 1
Description
In /lib/webrick/httpresponse.rb:295 the location response header is modified to include the request URI, creating an absolute URI. However, relative URIs are allowed in the location field. (See https://datatracker.ietf.org/doc/html/rfc7231#section-7.1.2).
This causes issues with reverse proxies and other proxy software. For instance, Hashicorp Boundary proxies a TCP connection through localhost using an ephemeral port to a destination web server. Because webrick does not allow relative URIs in this field, the client navigates to the resource on the wrong host or port (because the request port from the proxy != the client port to the proxy).
I think this segment of code should be removed entirely.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at lib/webrick/httpresponse.rb:295 and read how the Location response header is modified to include the request URI. Check the RFC guidance and the reverse-proxy scenario described in the issue; the work is done when relative Location URIs are no longer rewritten into absolute URIs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100