Skip to content

Support delete payload forwarding#133

Merged
geek merged 1 commit intohapijs:masterfrom
geek:delete
Oct 16, 2022
Merged

Support delete payload forwarding#133
geek merged 1 commit intohapijs:masterfrom
geek:delete

Conversation

@geek
Copy link
Copy Markdown
Member

@geek geek commented Oct 9, 2022

Fixes #124

Copy link
Copy Markdown
Member

@Nargonath Nargonath left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the work @geek.

@Nargonath Nargonath added the bug Bug or defect label Oct 10, 2022
@geek geek added this to the 10.0.1 milestone Oct 16, 2022
@geek geek merged commit 3e695df into hapijs:master Oct 16, 2022
@geek geek deleted the delete branch October 16, 2022 19:53
@lucasklaassen
Copy link
Copy Markdown

This change introduces a bug with DELETE request proxying

Hi! This change causes issues when proxying DELETE requests with passThrough: true.

Problem:

When a DELETE request is proxied, this code path now:

  1. Deletes content-length header (line ~106 in passThrough logic)
  2. Adds transfer-encoding: chunked (because 'delete' is now in CHUNKABLE)
  3. But content-length: 0 gets re-added by the underlying HTTP client

Result:

The request ends up with both transfer-encoding: chunked AND content-length: 0 headers, which violates RFC 7230. Most servers (including Express) correctly reject this with 400 Bad Request.

Reproduction:

// Any DELETE request through h2o2 proxy with passThrough: true
h.proxy({ passThrough: true, uri: "http://target-server/endpoint" });

Fix:

DELETE requests typically don't have request bodies, so they shouldn't need chunked encoding. Consider either:

  1. Remove 'delete' from CHUNKABLE array, or
  2. Add delete options.headers['content-length']; after setting transfer-encoding: chunked

Context:

This breaks serverless-offline HTTP proxy functionality and likely affects other h2o2 users proxying DELETE requests.

Related:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Bug or defect

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Cannot use a body with DELETE proxy method when passThrough is set to true

3 participants