WinHTTP POST with redirect - turns into GET RRS feed

  • Question

  • I have what appears to be a serious bug with the WinHTTP component.

    I have a webserver that just does redirects. And I have another webserver doing web-services.

    I then use  WinHTTP to do a POST to directly to the web-service server - and everything works fine.

    However - if I do the POST to the web server that does the redirection - WinHTTP sees the redirect, and correctly goes to the redirected server - but it changes the POST into a GET (which naturally produces the wrong results).

    Using curl as a client - instead of WinHTTP - this problem does not exist.

    I verified what is going over the wire by watching the transactions in WireShark.

    Friday, April 3, 2009 1:15 PM

All replies

  • For posterity...

    According to RFC1945 (the HTTP/1.0 specification), WinHTTP is just emulating very old bugs in other client software:

    302 Moved Temporarily
    The requested resource resides temporarily under a different URL. Since the redirection may be altered on occasion, the client should continue to use the Request-URI for future requests. The URL must be given by the Location field in the response. Unless it was a HEAD request, the Entity-Body of the response should contain a short note with a hyperlink to the new URI(s).
    If the 302 status code is received in response to a request using the POST method, the user agent must not automatically redirect the request unless it can be confirmed by the user, since this might change the conditions under which the request was issued.
    Note: When automatically redirecting a POST request after receiving a 302 status code, some existing user agents will erroneously change it into a GET request.

    It looks like the answer is to manually handle redirects in the code: Set the WINHTTP_DISABLE_REDIRECTS option then create a new connection if you get back a 3xx response. Don't forget to set a limit on the number of redirects you plan to handle
    • Proposed as answer by revengert Tuesday, February 9, 2010 4:58 AM
    Tuesday, February 9, 2010 4:57 AM