bugzilla at apache
Nov 6, 2009, 5:45 AM
Post #1 of 1
(64 views)
Permalink
|
|
[Bug 46709] Expect: 100-continue to an HTTP/1.0 server change Breaks .NET Web Services
|
|
https://issues.apache.org/bugzilla/show_bug.cgi?id=46709
--- Comment #2 from Sven Mueller <sven-apache[at]incase.de> 2009-11-06 05:45:21 UTC ---
Created an attachment (id=24500)
--> (https://issues.apache.org/bugzilla/attachment.cgi?id=24500)
Add support to completely ignore an "Expect: 100-continue" if env
"ignorecontinue" is set
We had a very similar issue, also with .NET clients.
As we have only relatively few clients affected by the problem (more detailed
description below), and those clients always come from the same IP, we were
able to solve the problem by the attached patch and setting the new
"ignorecontinue" environment variable for those clients.
Now to the problem itself:
In our case, the relevant URL is protected by HTTP basic auth. .Net clients
send the following header in our case:
>>>> CLIENT ----
POST /url HTTP/1.1
Content-Type: text/xml
Content-Length: 1113
Expect: 100-continue
Connection: Keep-Alive
Host: host.do.main
<<<< CLIENT ----
At this point, apache httpd (2.2.3 with patches from RedHat 5.4, but I saw no
relevant changes up to the current 2.2.14) reacts like requested by the client:
It responds immediately with an error code, in this case:
>>>> SERVER ----
HTTP/1.1 401 Authorization Required
Date: Wed, 04 Nov 2009 10:24:52 GMT
Server: Apache
WWW-Authenticate: Basic realm="Our Gateway"
Last-Modified: Thu, 17 Sep 2009 08:52:08 GMT
ETag: "23-473c221659e00"
Accept-Ranges: bytes
Content-Length: 35
Keep-Alive: timeout=15, max=10
Connection: Keep-Alive
Content-Type: text/html
<pre>
This is an error page
</pre>
<<<< SERVER ----
Problem here is that .Net can't handle this the way it should, the .Net client
actually keeps going by sending the body of the request, immediately followed
by the authenticated copy of the first request
>>>> CLIENT ----
<?xml version="1.0" encoding="UTF-8"?>
<Company_BXML...
POST /url HTTP/1.1
Content-Type: text/xml
Authorization: Basic <zensiert>
Content-Length: 1113
Expect: 100-continue
Host: host.do.main
<?xml version="1.0" encoding="UTF-8"?>
<Company_BXML...
<<<< CLIENT ----
Which httpd interprets as being a request of type:
<?xml....>POST
Which is obviously not a valid request, so httpd returns code 400
For some clients, it seems to help to simply disable keepalive (setenv
nokeepalive), but for some others, this only results in no authenticated
request being sent at all.
So we tried several workarounds:
1) Use any combination of the typical MSIE workaround settings, including
unclean ssl shutdown, downgrade-1.0, force-response-1.0. This resulted
in varying errors, mostly having just a single request come in, for which
code 401 was returned, then no other request following.
2) Return 417 if we knew it was a problematic customer and the Expect header
was set. This also just resulted in no further request coming in (no matter
wether nokeepalive was set or not).
Finally, I tried patching the httpd to allow to simply ignore the Expect header
from the known-bad clients. The resulting patch is attached. Please note that
I'm in no way an apache httpd expert, so the formating might be non-standard
and - more importantly - the logging I added might be wrong (ap_log_rerror
might be more correct than ap_log_error).
Anyway, I think the patch might be off use for others as well, and I would be
glad to see something similar in a future httpd release.
I don't think anyone would thing copyright might apply to this simple patch,
but just in case anyone is insane enough to do so, I hereby grant all rights
related to this patch to the apache foundation. I also release the "code" under
the apache license, the GNU (L)GPL (v2 or higher) or the BSD copyright (without
the advertisement clause), at the recipients choice.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe[at]httpd.apache.org
For additional commands, e-mail: bugs-help[at]httpd.apache.org
|
