Repository navigation
Conversation
Dial always installs a CheckRedirect wrapper to rewrite ws/wss schemes, which disables net/http's default 10-redirect limit, so a client without its own CheckRedirect followed redirects without bound. The wrapper now applies the same limit when it has no callback to delegate to.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dialalways setsCheckRedirecton its copy of the HTTP client so it can rewritews/wssredirect targets tohttp/https. net/http only applies its default policy (stop after 10 redirects) whenCheckRedirectis nil, so installing the wrapper removes that limit. When the caller's client has noCheckRedirectof its own (includinghttp.DefaultClient), the wrapper returned nil andDialfollowed redirects without bound. A server that redirects to itself keeps the handshake looping until the context expires, andviagrows on each hop. If the context has no deadline and the transport doesn't check it, the loop never ends.This change makes the wrapper apply the same
len(via) >= 10check as net/http'sdefaultCheckRedirectwhen there is no caller callback to delegate to. A caller-providedCheckRedirectis still called as before and decides on its own.What this PR does not do: it doesn't change whether
Dialfollows redirects. The issue also proposes not following redirects by default (as browsers and gorilla/websocket do). That is a behaviour change that needs a maintainer decision, so it is left out. This PR only restores the limit callers already expect from a plainhttp.Client.Test:
TestDialRedirectLimituses a mock transport that always redirects (and stops after 20 hops so the test can't hang). With the change,Dialfails with "stopped after 10 redirects" after 10 requests. Without it, the test sees 21 requests and the final 404.Thanks to the comment on the issue that traced this and suggested the bound.
Refs #518