HttpURLConnection does not support HTTP/308 (Permanent Redirect). HTTP/308 is similar to HTTP/301, but clients must not change the HTTP method.

Further, the implementation does not allow changing the protocol for all redirects. A "Location" header with a different protocol, for example a request to http://... responded with a "Location: https://..." breaks HttpURLConnection's redirection.

It was quite impossible to track down the reasons behind this behavior. The code is probably older than the "Initial load" into Mercurial and the respective RFCs.

The new HttpClient in the JDK (java.net.http.HttpClient) handles all the above cases correctly.

Given that there are no other reports of this issue, I suspect that the only legit change for older Java versions would be to allow HTTP/308. Allowing a protocol change in HttpURLConnection is actually a change in behavior and therefore not a good idea to backport into LTS releases like 11 or 8. Maybe it’s easier and more consistent to refactor Http(s)URLConnection to "just" use the HttpClient.

References:

HttpURLConnection „blame": https://github.com/openjdk/jdk/blame/e01cd7c3ed923cd19509fc972ba6e4aa2991289f/src/java.base/share/classes/sun/net/www/protocol/http/HttpURLConnection.java#L982-L983

Current RFC 9110: https://www.rfc-editor.org/rfc/rfc9110.html#name-308-permanent-redirect, obsoleted https://www.rfc-editor.org/rfc/rfc7538, obsoleted https://www.rfc-editor.org/rfc/rfc7238

net-dev mailing list reference: https://mail.openjdk.java.net/pipermail/net-dev/2022-June/018417.html