Skip to content

[BC Break] Form POSTs w/o Accept return application/x-www-form-urlencoded response Content-Type #34906

Closed
@weaverryan

Description

@weaverryan

Symfony version(s) affected: 4.4.0

Description
Hi! Due to #32344, if you POST a form submit but do not send any Accept headers, the response Content-Type will be the invalid application/x-www-form-urlencoded.

This doesn't happen in practice in a browser (which sends an Accept header), but DOES happen in functional tests - and is very difficult to debug.

The problem is that, in $response->prepare(), $request->getPreferredFormat() is called to try to figure out the correct Content-Type. If there is no Accept header, it eventually falls back to to using the request Content-Type as the default value:

$this->preferredFormat = $this->getRequestFormat($preferredFormat ?: $this->getContentType());

But in 4.3, it used "html".

How to reproduce
Set up or find any deployed 4.4 form submit. Submit in your browser, then use the "Copy as Curl" tool in your browser network tools. Paste that into your terminal, but remove the -H Accept header.

That's it! Check out the Content-Type header on the response.

Possible Solution
The last 2 lines of Request::getPreferredFormat() should maybe be:

- $this->preferredFormat = $this->getRequestFormat($preferredFormat ?: $this->getContentType());
+ $this->preferredFormat = $this->getRequestFormat($preferredFormat ?: $default);

Ping @yceruto :)

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions