Opened 3 years ago

#1010 new defect

Invalid request sent when serving error pages from upstream

Reported by: sorin-manole@… Owned by:
Priority: minor Milestone:
Component: nginx-core Version: 1.10.x
Keywords: Cc:
uname -a:
nginx -V: nginx version: nginx/1.10.1 built by gcc 4.1.2 20080704 (Red Hat 4.1.2-54) configure arguments: --without-http_rewrite_module

Description

The bug appears when request_body_buffering is off (but maybe not only), and error pages are set to be served from an upstream using an internal redirect.

If a problem happens while the request body is read/sent to the upstream in a non-buffered fashion, and nginx tries to serve an error page, it rewrites the HTTP method from POST to GET request, but keeps the old value of the Content-Length header when trying to serve the error page from the upstream.

This is done here: https://trac.nginx.org/nginx/browser/nginx/src/http/ngx_http_special_response.c#L575

For example:
===
POST /do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 100

<body>
===
gets transformed into
===
GET /5xx.html HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 100

===

No body data is sent in the error page upstream request, even though it is declared in the header, which can cause the upstream server to wait for it. This is seen by the client as the request hanging until the configured upstream timeout.

Can this be fixed by clearing any Content-Length or Transfer-Encoding headers when error pages are served?

Change History (0)

Note: See TracTickets for help on using tickets.