Skip to content

fix(dial): keep the default redirect limit when CheckRedirect is nil - #589

Open
mraj602 wants to merge 1 commit into
coder:masterfrom
mraj602:fix/dial-redirect-limit
Open

mraj602 wants to merge 1 commit into
coder:masterfrom
mraj602:fix/dial-redirect-limit

Conversation

@mraj602

@mraj602 mraj602 commented Oct 28, 2026

Copy link
Copy Markdown

Dial always sets CheckRedirect on its copy of the HTTP client so it can rewrite ws/wss redirect targets to http/https. net/http only applies its default policy (stop after 10 redirects) when CheckRedirect is nil, so installing the wrapper removes that limit. When the caller's client has no CheckRedirect of its own (including http.DefaultClient), the wrapper returned nil and Dial followed redirects without bound. A server that redirects to itself keeps the handshake looping until the context expires, and via grows on each hop. If the context has no deadline and the transport doesn't check it, the loop never ends.

This change makes the wrapper apply the same len(via) >= 10 check as net/http's defaultCheckRedirect when there is no caller callback to delegate to. A caller-provided CheckRedirect is still called as before and decides on its own.

What this PR does not do: it doesn't change whether Dial follows redirects. The issue also proposes not following redirects by default (as browsers and gorilla/websocket do). That is a behaviour change that needs a maintainer decision, so it is left out. This PR only restores the limit callers already expect from a plain http.Client.

Test: TestDialRedirectLimit uses a mock transport that always redirects (and stops after 20 hops so the test can't hang). With the change, Dial fails with "stopped after 10 redirects" after 10 requests. Without it, the test sees 21 requests and the final 404.

Thanks to the comment on the issue that traced this and suggested the bound.

Refs #518

Dial always installs a CheckRedirect wrapper to rewrite ws/wss schemes,
which disables net/http's default 10-redirect limit, so a client without
its own CheckRedirect followed redirects without bound. The wrapper now
applies the same limit when it has no callback to delegate to.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant