[New-bugs-announce] [issue47150] HTTPRedirectHandler fails on POST for 307 and 308

[Jairo Llopis]

New submission from Jairo Llopis <yajo.sk8 at gmail.com>:

urllib.request.HTTPRedirectHandler fails if there is a 307 HTTP return code in a POST request.

In https://github.com/python/cpython/commit/c379bc5ec9012cf66424ef3d80612cf13ec51006 the same behaviour was implemented for 308.

According to https://datatracker.ietf.org/doc/html/rfc7538#section-3 IMHO this implementation is wrong for 308:

> Note: This status code is similar to 301 (Moved Permanently)
> ([RFC7231], Section 6.4.2), except that it does not allow changing
> the request method from POST to GET.

A similar note exists in https://datatracker.ietf.org/doc/html/rfc7231#section-6.4.7 regarding code 307.

So, as long as the original redirection is in POST and it gets redirected to another POST, it should not be an error.

FWIW, in https://github.com/traefik/traefik/issues/7829#issuecomment-770210080 you can see that Traefik proxy uses 307 and 308 codes by default when redirecting non-GET requests.

Thus, urllib.request.HTTPRedirectHandler will fail to process any POST requests proxied by Traefik.

----------
components: Library (Lib)
messages: 416249
nosy: Jairo Llopis
priority: normal
severity: normal
status: open
title: HTTPRedirectHandler fails on POST for 307 and 308
type: behavior
versions: Python 3.10, Python 3.11, Python 3.8, Python 3.9

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue47150>
_______________________________________