Opened 8 years ago
#1010 new defect
Invalid request sent when serving error pages from upstream
| Reported by: | Owned by: | ||
|---|---|---|---|
| Priority: | minor | Milestone: | |
| Component: | nginx-core | Version: | 1.10.x |
| Keywords: | Cc: | ||
| uname -a: | |||
| nginx -V: |
nginx version: nginx/1.10.1
built by gcc 4.1.2 20080704 (Red Hat 4.1.2-54) configure arguments: --without-http_rewrite_module |
||
Description
The bug appears when request_body_buffering is off (but maybe not only), and error pages are set to be served from an upstream using an internal redirect.
If a problem happens while the request body is read/sent to the upstream in a non-buffered fashion, and nginx tries to serve an error page, it rewrites the HTTP method from POST to GET request, but keeps the old value of the Content-Length header when trying to serve the error page from the upstream.
This is done here: https://trac.nginx.org/nginx/browser/nginx/src/http/ngx_http_special_response.c#L575
For example:
===
POST /do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 100
<body>
===
gets transformed into
===
GET /5xx.html HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 100
===
No body data is sent in the error page upstream request, even though it is declared in the header, which can cause the upstream server to wait for it. This is seen by the client as the request hanging until the configured upstream timeout.
Can this be fixed by clearing any Content-Length or Transfer-Encoding headers when error pages are served?
