13493: Merge branch 'master' into 13493-federation-proxy

[arvados.git] / lib / controller / handler.go

diff --git a/lib/controller/handler.go b/lib/controller/handler.go
index c50f98273c10bc19e0b9da44409f53545c636461..69b1866162c6fe1488ba3ca0b76d92817a4658ef 100644 (file)
--- a/lib/controller/handler.go
+++ b/lib/controller/handler.go
@@ -35,6 +35,20 @@ type Handler struct {
 
 func (h *Handler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
        h.setupOnce.Do(h.setup)
+       if req.Method != "GET" && req.Method != "HEAD" {
+               // http.ServeMux returns 301 with a cleaned path if
+               // the incoming request has a double slash. Some
+               // clients (including the Go standard library) change
+               // the request method to GET when following a 301
+               // redirect if the original method was not HEAD
+               // (RFC7231 6.4.2 specifically allows this in the case
+               // of POST). Thus "POST //foo" gets misdirected to
+               // "GET /foo". To avoid this, eliminate double slashes
+               // before passing the request to ServeMux.
+               for strings.Contains(req.URL.Path, "//") {
+                       req.URL.Path = strings.Replace(req.URL.Path, "//", "/", -1)
+               }
+       }
        h.handlerStack.ServeHTTP(w, req)
 }
 
@@ -68,6 +82,11 @@ func (h *Handler) setup() {
                Name:           "arvados-controller",
                RequestTimeout: time.Duration(h.Cluster.HTTPRequestTimeout),
        }
+
+       // Changing the global isn't the right way to do this, but a
+       // proper solution would conflict with an impending 13493
+       // merge anyway, so this will do for now.
+       arvados.InsecureHTTPClient.CheckRedirect = func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }
 }
 
 var errDBConnection = errors.New("database connection error")