search

ChrisMacNaughton / vault-rs

https://docs.rs/hashicorp_vault
61 stars 27 forks source link

301 result redirection changes HTTP verb #55

Open moosterhof opened 3 years ago

moosterhof commented 3 years ago

Hi! I've been using this for a small project, and I notice that when Vault returns a 301, my POST (or PUT) verb turns into a GET verb. So it seems when following 301's the verb is reset.

You can test this by doing an API call to /sys/tools/random, Vault will rewrite with a 301 to /v1//sys/tools/random and to /v1/sys/tools/random and in the process the POST verb is lost.

dimfeld commented 3 years ago

Most HTTP clients (including web browsers) act like this. Generally the 307 or 308 codes are used to indicate that the request should be retried with the original verb and payload. (see https://github.com/seanmonstar/reqwest/issues/912 for the reqwest-specific comment)

Bringing this up with Hashicorp might be best, although I expect they'll just say to use the v1 path since then your code is guaranteed not to break when upgrading Vault. Otherwise, this could be handled by disabling reqwest's redirect handling and doing it manually.