1365027 - Add $httpMethod=POST to the query string of Safe Browsing pver4 requests

Status: RESOLVED FIXED

(Toolkit :: Safe Browsing, enhancement, P2)

Description

[François Marier [:francois]]

One of the things that would explain the 404s we are seeing on the Safe Browsing V4 endpoint (updates and completions):

https://mzl.la/2puc95V
https://mzl.la/2pDpw3T

is the absence of the X-HTTP-Method-Override header which we set on updates and completions:

https://searchfox.org/mozilla-central/rev/e2e90c1b4e8f86ba3df4aa189386b6102627c475/toolkit/components/url-classifier/nsUrlClassifierStreamUpdater.cpp#158-173
https://searchfox.org/mozilla-central/rev/484d2b7f51b7aed035147bbb4a565061659d9278/toolkit/components/url-classifier/nsUrlClassifierHashCompleter.js#443

The likely culprit is anti-virus MITM proxies that could drop this header.

There is a work-around that should work: adding "&$httpMethod=POST" to the query string. This will cause the Google front-end servers to change the request into a POST request even if the header is missing.

Comment 1

[Dimi Lee [:dimi]]

Attachment: Bug 1365027 - Add $httpMethod=POST to the query string of Safe Browsing pver4 requests.

Review commit: https://reviewboard.mozilla.org/r/139692/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/139692/

Comment 2

[François Marier [:francois]]

Comment on attachment 8868078 [details]
Bug 1365027 - Add $httpMethod=POST to the query string of Safe Browsing pver4 requests.

https://reviewboard.mozilla.org/r/139692/#review143206

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3876e96601b1
Add $httpMethod=POST to the query string of Safe Browsing pver4 requests. r=francois

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/3876e96601b1