Skip to content

[HttpClient] HEAD request turns into PUT request since 7.2.0 #59043

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dmaicher opened this issue Nov 29, 2024 · 2 comments
Closed

[HttpClient] HEAD request turns into PUT request since 7.2.0 #59043

dmaicher opened this issue Nov 29, 2024 · 2 comments

Comments

@dmaicher
Copy link
Contributor

Symfony version(s) affected

7.2.0

Description

Just upgraded one project to Symfony 7.2.0 and noticed an error with a Psr18Client wrapping a CurlHttpClient

The HEAD request actually turns into a PUT request.

How to reproduce

$response = (new Psr18Client(new CurlHttpClient()))
    ->sendRequest(new Request('HEAD', 'https://www.postb.in/1732890887317-...'));

image

Possible Solution

No response

Additional Context

This seems to be caused by #58856

Now the CurlHttpClient is sending a body as it seems:

cc @KurtThiemann

@KurtThiemann
Copy link
Contributor

After some initial testing, it seems like this happens if CURLOPT_UPLOAD is set to true after CURLOPT_NOBODY is set, without also setting CURLOPT_CUSTOMREQUEST to head. This is something I believe would have always happened when using the CurlHttpClient with an empty stream as body to send a HEAD request, but nobody ever noticed because why would you do that.

Would there be anything wrong with just always explicitly setting CURLOPT_CUSTOMREQUEST instead of only relying on things like CURLOPT_UPLOAD or CURLOPT_NOBODY?

@KurtThiemann
Copy link
Contributor

(cc @nicolas-grekas )
Actually, no idea who's in charge here, but since you reviewed my original pr maybe you have some insight into how we should proceed to fix the issue.

I was able to verify that the issue can also occur when using the CurlHttpClient directly without the PSR-18 wrapper:

$client = \Symfony\Component\HttpClient\HttpClient::create();

//This sends a PUT request
$client->request("HEAD", "http://localhost/", [
    "body" => function ($chunkSize) {
        return "";
    }
]);

While this is not something anyone would normally write, I don't think it should send a PUT request.

nicolas-grekas added a commit that referenced this issue Dec 2, 2024
…ct HTTP method in CurlHttpClient (KurtThiemann)

This PR was submitted for the 7.2 branch but it was squashed and merged into the 6.4 branch instead.

Discussion
----------

[HttpClient] Always set CURLOPT_CUSTOMREQUEST to the correct HTTP method in CurlHttpClient

| Q             | A
| ------------- | ---
| Branch?       | 7.2
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Issues        | Fix #59043
| License       | MIT

Currently, when sending a `HEAD` request and using a closure as the request body using `CurlHttpClient`, a `PUT` request instead of a HEAD request will be sent. This is because `CURLOPT_NOBODY` is set to make a `HEAD` request, but is overwritten by `CURLOPT_UPLOAD`, which is necessary to make curl call `CURLOPT_READFUNCTION`, but also sets the HTTP method to `PUT`.
The solution I am suggesting is to just always set `CURLOPT_CUSTOMREQUEST`, so the correct HTTP method will be used, no matter what other options are added.

This is mainly an issue in the PSR-18 wrapper, since PSR requests always have a request body stream, even if the body is empty. Since #58856, `Psr18Client` always passes a closure as the request body to the underlying HTTP client instead of just reading the entire request body stream into a string, as that made it impossible to upload large files.

While it would be possible to add an exception to `Psr18Client` to only add the request body if the method used commonly has a body, I think the better solution is to ensure that  `CurlHttpClient` always actually sends the type of request that it is asked to send.

Commits
-------

bfdf5d9 [HttpClient] Always set CURLOPT_CUSTOMREQUEST to the correct HTTP method in CurlHttpClient
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants