HttpURLConnection: HttpClient and HttpsClient incorrectly check request method when set to POST

    IssueFix VersionAssigneePriorityStatusResolutionResolved In Build
    JDK-827592217.0.2 Evan WhelanP3ResolvedFixedb03
    JDK-827609215.0.6 Yuri NesterenkoP3ResolvedFixedb02
    JDK-827609713.0.10 Yuri NesterenkoP3ResolvedFixedb02
    JDK-827596111.0.14-oracle Evan WhelanP3ResolvedFixedb00
    JDK-827608911.0.14 Goetz LindenmaierP3ResolvedFixedb01
    JDK-8276762openjdk8u322 Zhengyu GuP3ResolvedFixedb02
    JDK-82760698u331 Evan WhelanP3ResolvedFixedb01
    JDK-82791128u321 Evan WhelanP3ResolvedFixedb31
    JDK-82769008u311 Evan WhelanP3ClosedFixedb32

      URLConnection pools HttpClient / HttpsClient to serve connections to the same server. When picking up the HttpClient/HttpsClient from the pool, the check is performed whether the connection is still usable. However, this logic is broken for POST requests.

      https://github.com/openjdk/jdk/blob/722d639fad2e4fc6eb2aabd427e2719501899cfe/src/java.base/share/classes/sun/net/www/http/HttpClient.java#L310

      - this line checks for literal value of "POST", whereas it should check for equality.
      As a consequence, the check is performed as intended only if the request method is set using a literal string "POST". The check is not performed, if the request method is set to "POST", but the string is constructed - e.g. read from a property or extracted from configuration.
      A similar issue exists in HttpsClient.

      Expected behaviour:
      The connection liveness check behaviour should be identical, irrespective of how the request method is set.

      Proof:
      A patch for application-side code checking whether the request method is equal to "POST", and setting the requestMethod to a literal "POST", solves the issue on the application side.

        backported by

        Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port.JDK-8275922HttpURLConnection: HttpClient and HttpsClient incorrectly check request method when set to POST

        • P3 - Major loss of function.
        • Resolved

        Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port.JDK-8275961HttpURLConnection: HttpClient and HttpsClient incorrectly check request method when set to POST

        • P3 - Major loss of function.
        • Resolved

        Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port.JDK-8276069HttpURLConnection: HttpClient and HttpsClient incorrectly check request method when set to POST

        • P3 - Major loss of function.
        • Resolved

        Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port.JDK-8276089HttpURLConnection: HttpClient and HttpsClient incorrectly check request method when set to POST

        • P3 - Major loss of function.
        • Resolved

        Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port.JDK-8276092HttpURLConnection: HttpClient and HttpsClient incorrectly check request method when set to POST

        • P3 - Major loss of function.
        • Resolved

        Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port.JDK-8276097HttpURLConnection: HttpClient and HttpsClient incorrectly check request method when set to POST

        • P3 - Major loss of function.
        • Resolved

        Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port.JDK-8276762HttpURLConnection: HttpClient and HttpsClient incorrectly check request method when set to POST

        • P3 - Major loss of function.
        • Resolved

        Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port.JDK-8279112HttpURLConnection: HttpClient and HttpsClient incorrectly check request method when set to POST

        • P3 - Major loss of function.
        • Resolved

        Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port.JDK-8276900HttpURLConnection: HttpClient and HttpsClient incorrectly check request method when set to POST

        • P3 - Major loss of function.
        • Closed
        links to

        CommitCommitopenjdk/jdk11u-dev/9cc66169

          CommitCommitopenjdk/jdk13u-dev/9e76ccb2

            CommitCommitopenjdk/jdk15u-dev/ca609529

              CommitCommitopenjdk/jdk17u/a1dc5955

                CommitCommitopenjdk/jdk/45ce06c9

                  ReviewReviewopenjdk/jdk11u-dev/562

                    ReviewReviewopenjdk/jdk13u-dev/284

                      ReviewReviewopenjdk/jdk15u-dev/123

                        ReviewReviewopenjdk/jdk17u/212

                          ReviewReviewopenjdk/jdk/5964

                            (4 backported by, 10 links to)