Re: [servlet-dev] CONNECT and getRequestURI ?

[Masao Sato <masato@xxxxxxxxxx>]

>I'll note that the Spec document explicitly states that the CONNECT
>method is not supported.

Because of that the CONNECT request could not be treated as a normal
http request,
HttpServlet and HttpServletRequest  are not filt to handle it.
The spec has a Servlet and ServletReqeust ( not HttpServletRequest ) interfaces
for generic protocols, all extended methods from ServletRequest except
getMethod()
should throw some exception. and the application should forward to  a
servlet which
inherited Servlet ( not HttpServlet ) by calling
ServletRequest#getRequestDispatcher().

Regards,
Masao Sato

2023年2月14日(火) 18:32 Mark Thomas <markt@xxxxxxxxxx>:
>
> On 14/02/2023 00:15, Stuart Douglas wrote:
> > If you don't like null because of the potential for NPEs I think you
> > could also make a similar argument for the empty string. If developers
> > are not thinking about connect requests they could assume that it will
> > always be at least length 1 and you could end up with different exceptions.
> >
> > Stuart
> >
> > On Tue, 14 Feb 2023 at 11:07, Greg Wilkins <gregw@xxxxxxxxxxx
> > <mailto:gregw@xxxxxxxxxxx>> wrote:
> >
> >
> >     So options are now null, "" and "/".  Older jetty was "", newer
> >     jetty is null and undertow is "/".
> >     Where does tomcat land in this?   I'm very happy to change jetty to
> >     anything, I just want it to be standard.
> >     I think null is probably my least favourite and I'm on fence with ""
> >     vs "/".
>
> Tomcat currently returns a 400 response.
>
> I'll note that the Spec document explicitly states that the CONNECT
> method is not supported.
>
> Unless we think there are web applications that actually want to
> implement CONNECT, I'm leaning towards requiring a 405 response to all
> CONNECT requests.
>
> I found one request to implement CONNECT on the Tomcat users list from
> 2016 and I'm not convinced that was the correct solution to the problem
> the user was facing.
>
> If we do change the spec to permit CONNECT requests, then I think we'll
> need to:
> - add a doConnect() method to HttpServlet
> - specify the expected value for getRequestURI()
> - specify how the CONNECT request is mapped to a Servlet
>
> Mark
> _______________________________________________
> servlet-dev mailing list
> servlet-dev@xxxxxxxxxxx
> To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/servlet-dev



-- 
レッドハット株式会社
サービス事業統括本部
佐藤 将夫