1805182 - HTTP 307 redirect forgets request’s body after initial redirection

Status: ASSIGNED

(Core :: DOM: Navigation, defect, P3)

Description

[interdist]

Steps to reproduce:

When a website issues a 307 Temporary Redirect for a POST request, Firefox is supposed to treat it as a new POST request with the original request parameters. These are preserved only for the initial redirection, and are lost after that.

Actual results:

Refreshing the page issues a GET request with the original request body being lost.

Expected results:

The POST request is reissued with the appropriate warning dialog box shown beforehand. This is the behavior of every other browser, including Internet Explorer.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking: HTTP' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[interdist]

I just verified that Firefox 107 on Android does in fact behave correctly, requesting the user to confirm the re-submission of the POST data. Therefore, the bug affects only the desktop version of Firefox.

Comment 3

[Kershaw Chang [:kershaw]]

Hi Reporter,

Could you provide a link for us to test?
Or could you try to capture a http log that shows this behavior?
Note that the log may contain some privacy, so you may want to send it to [e-mail].

Thanks.

Comment 4

[interdist]

Hi Kershaw, I sent an HTTP log over email. It should show the initial POST request which receives a 307 response from the server, and is properly resubmitted to the new URL as a POST request. After I refresh the page (F5), a GET request is issued with the request parameters lost.

Comment 5

[Kershaw Chang [:kershaw]]

Thanks for the log, but I can't find anything wrong from networking point of view.
Looks like this is an issue in DOM, so I'll change the component.

Reporter, do you mind sharing the steps to reproduce here?
Thanks.

Comment 6

[interdist]

(In reply to Kershaw Chang [:kershaw] from comment #5)

Steps to reproduce:

1. Open a web page which contains a form submitted over POST to an endpoint responding with HTTP 307.
2. Observe Firefox (on Desktop) being redirected to the new URL with the original form data.
3. Refresh the new page via F5.
4. The new URL is reloaded via GET request with no form data being resubmitted, instead of inquiring whether the user wants to repeat the submission and issuing a POST request.

Comment 7

[Sean Feng [:sefeng]]

I needinfo myself to take a look

Comment 8

[Sean Feng [:sefeng]]

Attachment: Bug 1805182 - Fix the bug where postData is lost when the LoadingSessionHistoryEntry is replaced for redirect r=peterv,smaug

The postData should be carried over when we replace the
LoadingSessionHistoryEntry for the redirect.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7e708c1c9d9d
Fix the bug where postData is lost when the LoadingSessionHistoryEntry is replaced for redirect r=peterv

Comment 10

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/813138e96493
Backed out changeset 7e708c1c9d9d for causing SessionHistory related failures.

Comment 11

[Cosmin Sabou [:CosminS]]

Backed out for causing SessionHistory related failures.

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception%2Cusercancel&tochange=6a7b19193977d4df2d73c51bc57be3be83ea49bf&selectedTaskRun=N0arxGUeReKueG4QLMcpnw.0

Failure log: https://treeherder.mozilla.org/logviewer?job_id=402900974&repo=autoland

Backout link: https://hg.mozilla.org/integration/autoland/rev/813138e96493657f79138011f597b904c2842ff0

Comment 12

[Sean Feng [:sefeng]]

I'll need to update the patch.