Apache HTTP client doesn't respect HTTP status code 307 - apache-httpclient-4.x

Question

When our Android client doest a request to our server with Apache HTTP client I want it to redirect to a new url (or more specific, an other context path) with the same HTTP method.
In my httpd.conf I sat up this rule with status code 307:
Redirect 307 /mybipper/reg /mybipperapi/old/reg
According to the status code description in Wikipedia a 307 should:
http://en.wikipedia.org/wiki/HTTP_307#3xx_Redirection
307 Temporary Redirect (since HTTP/1.1)
In this case, the request should be repeated with another URI; however, future requests can still use the original URI.[2] In contrast to how 302 was historically implemented, the request method should not be changed when reissuing the original request. For instance, a POST request must be repeated using another POST request.
But in my access log we see that HTTP client doesnt seem to respect it and executes a GET instead just as if I returned a status code 302
172.29.9.120 - - [21/Sep/2012:14:02:11 +0300] "POST /mybipper/reg HTTP/1.1" 307 248
172.29.9.120 - - [21/Sep/2012:14:02:11 +0300] "GET /mybipperapi/old/reg HTTP/1.1" 400 1016
According to Apache HTTP Client web site its a bit unclear how it should handle status code 307, but they list it at least there.
http://hc.apache.org/httpclient-3.x/redirects.html
I have a strong feeling its Apache HTTP client which doesn't implement the HTTP 1.1 protocol correctly, am I correct or have I misunderstood something?
The Apache HTTP client we use is bundled with the Android SDK. The phone I was testing on had Android SDK 15, ergo this one:
http://developer.android.com/about/versions/android-4.0.3.html

Answer 1

The DefaultRedirectStrategy only allows GET and HEAD to be redirected automatically. If you want to also allow POST (but not PUT or DELETE), you can switch to the LaxRedirectStrategy by doing something like:
HttpClientBuilder hcb = HttpClients.custom();
hcb.setRedirectStrategy(new LaxRedirectStrategy());
HttpClient client = hcb.build();
If you want to also follow PUT and DELETE (like we do here), you'll have to implement a custom strategy (note: we ran into a bug in the HttpClient where it appears it was trying to add a second Content-Length header when we do this, so we manually remove it. YMMV). By using this strategy, HttpClient will also support 308 redirects, something the Apache team couldn't even be bothered to include.
You can do something like this:
hcb.setRedirectStrategy(new DefaultRedirectStrategy() {
public boolean isRedirected(HttpRequest request, HttpResponse response, HttpContext context) throws ProtocolException {
Args.notNull(request, "HTTP request");
Args.notNull(response, "HTTP response");
int statusCode = response.getStatusLine().getStatusCode();
switch(statusCode) {
case 301:
case 307:
case 302:
case 308:
case 303:
return true;
case 304:
case 305:
case 306:
default:
return false;
}
}
public HttpUriRequest getRedirect(HttpRequest request, HttpResponse response, HttpContext context) throws ProtocolException {
URI uri = this.getLocationURI(request, response, context);
String method = request.getRequestLine().getMethod();
if(method.equalsIgnoreCase("HEAD")) {
return new HttpHead(uri);
} else if(method.equalsIgnoreCase("GET")) {
return new HttpGet(uri);
} else {
int status = response.getStatusLine().getStatusCode();
HttpUriRequest toReturn = null;
if(status == 307 || status == 308) {
toReturn = RequestBuilder.copy(request).setUri(uri).build();
toReturn.removeHeaders("Content-Length"); //Workaround for an apparent bug in HttpClient
} else {
toReturn = new HttpGet(uri);
}
return toReturn;
}
}
});

Answer 2

To expand on Cody's correct answer - if you need to follow PUT (or any other method) 307 redirects then you can alternatively extend LaxRedirectStrategy which is even easier:
hcb.setRedirectStrategy(new LaxRedirectStrategy()
{
protected boolean isRedirectable(String method)
{
return "PUT".equalsIgnoreCase(method)||super.isRedirectable(method);
}
});
However that will not fix the issue of following 308s as well. I know this is an old question but I hit the same issue just today (thanks Cody).

Answer 3

if you want to add 308 as well to LaxRedirectStrategy - see code below
.setRedirectStrategy(new LaxRedirectStrategy() {
#Override
public boolean isRedirected(
final HttpRequest request,
final HttpResponse response,
final HttpContext context) throws ProtocolException {
Args.notNull(request, "HTTP request");
Args.notNull(response, "HTTP response");
final int statusCode = response.getStatusLine().getStatusCode();
final String method = request.getRequestLine().getMethod();
final Header locationHeader = response.getFirstHeader("location");
switch (statusCode) {
case HttpStatus.SC_MOVED_TEMPORARILY:
return isRedirectable(method) && locationHeader != null;
case HttpStatus.SC_MOVED_PERMANENTLY:
case HttpStatus.SC_TEMPORARY_REDIRECT:
return isRedirectable(method);
case HttpStatus.SC_SEE_OTHER:
return true;
case 308:
return true;
default:
return false;
} //end of switch
}
})
.build();```