Bug 65380 - "Location" header not covered in ap_headers_error_filter
Summary: "Location" header not covered in ap_headers_error_filter
Status: NEW
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_headers (show other bugs)
Version: 2.4.48
Hardware: PC All
: P2 normal (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-06-15 08:50 UTC by Ronnie Brunner
Modified: 2021-06-24 08:07 UTC (History)
0 users



Attachments
mod_header.c patch to support Location header in ap_headers_error_filter (4.09 KB, patch)
2021-06-15 08:50 UTC, Ronnie Brunner
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Ronnie Brunner 2021-06-15 08:50:01 UTC
Created attachment 37896 [details]
mod_header.c patch to support Location header in ap_headers_error_filter

http_protocol.c. has special handling for "Location" header in ap_send_error_response (i.e. take Location from r->headers_out if available and only fall back to r->err_headers_out if it's not in r->headers_out). And it is (best) practice to put the Location header in r-> headers_out.

In mod_headers.c ap_headers_error_filter, only the r->err_headers_out are fixed up (line 893):

    /*
     * Add any header fields defined by "Header always" to r->err_headers_out.
     * Server-wide first, then per-directory to allow overriding.
     */
    do_headers_fixup(f->r, f->r->err_headers_out, dirconf->fixup_err, 0);

This effectively prevents manipulation of the Location header on Redirects.

If instead, the special case for the Location header would also be considered in mod_headers, it could be properly manipulated with 

   Header always <action> Location

in the config.

The attached patch (untested, not even attempted to comile) could do the trick.
Comment 1 Ruediger Pluem 2021-06-15 10:47:01 UTC
Does

Header <action> Location

work to adjust the Location header (note I removed always)?
Comment 2 Ronnie Brunner 2021-06-24 08:07:18 UTC
(In reply to Ruediger Pluem from comment #1)
> Does
> 
> Header <action> Location
> 
> work to adjust the Location header (note I removed always)?

It sometimes does :-). No seriously, you can set the Location header in your config file (might even make sense in some rare cases) and you can then also midify it. It also works if your App sets the Location, but returns a successful HTTP code back (also rather rare ;-)...) but again: it oftne doesn't work for exactly the reason that it is handeled as a special case by http_protocol.c, which mod_headers doesn't respect.