-
Bug
-
Resolution: Fixed
-
P4
-
8, 9
-
b07
-
generic
-
generic
-
Verified
Issue | Fix Version | Assignee | Priority | Status | Resolution | Resolved In Build |
---|---|---|---|---|---|---|
JDK-8329168 | 17.0.12-oracle | Sean Coffey | P4 | Resolved | Fixed | b02 |
JDK-8329402 | 17.0.12 | Goetz Lindenmaier | P4 | Resolved | Fixed | b01 |
JDK-8329274 | 11.0.24-oracle | Sean Coffey | P4 | Resolved | Fixed | b02 |
JDK-8330888 | 11.0.24 | Amos SHI | P4 | Resolved | Fixed | b01 |
A DESCRIPTION OF THE PROBLEM :
RFC 7231 [0] describes the format of the HTTP/1.1 Accept header as follows:
Accept = #( media-range [ accept-params ] )
media-range = ( "*/*"
/ ( type "/" "*" )
/ ( type "/" subtype )
) *( OWS ";" OWS parameter )
accept-params = weight *( accept-ext )
accept-ext = OWS ";" OWS token [ "=" ( token / quoted-string ) ]
HttpURLConnection sets the following Accept header in requests if it is not set [1]:
static final String acceptString =
"text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2";
The '*; q=.2' portion seems to be invalid according to the RFC spec above.
Some http endpoints that encounter this header will reject the request and return 406 or 500. For examples see: [2] and [3].
[0]: https://tools.ietf.org/html/rfc7231#section-5.3.2
[1]: https://github.com/openjdk-mirror/jdk/blob/jdk8u/jdk8u/master/src/share/classes/sun/net/www/protocol/http/HttpURLConnection.java#L256
[2]: https://issues.apache.org/jira/browse/SLING-3175
[3]: https://issues.apache.org/jira/browse/OLINGO-998
REPRODUCIBILITY :
This bug can be reproduced always.
CUSTOMER SUBMITTED WORKAROUND :
It is possible for clients to set the Accept header via the HttpURLConnection.setRequestProperty API.
- backported by
-
JDK-8329168 HttpURLConnection default Accept header is malformed according to HTTP/1.1 RFC
- Resolved
-
JDK-8329274 HttpURLConnection default Accept header is malformed according to HTTP/1.1 RFC
- Resolved
-
JDK-8329402 HttpURLConnection default Accept header is malformed according to HTTP/1.1 RFC
- Resolved
-
JDK-8330888 HttpURLConnection default Accept header is malformed according to HTTP/1.1 RFC
- Resolved
- duplicates
-
JDK-8177439 HttpUrlConnection sends illegal "Accept" header field
- Closed
- relates to
-
JDK-8337684 [17/11u] Revert JDK-8163921 backport
- New
-
JDK-8339470 [17u] More defensive fix for 8163921
- Resolved
- links to
-
Commit openjdk/jdk11u-dev/295a8cd3
-
Commit openjdk/jdk17u-dev/b37df147
-
Commit openjdk/jdk/28796cbd
-
Review openjdk/jdk11u-dev/2645
-
Review openjdk/jdk17u-dev/2343
-
Review openjdk/jdk/7181