aws / aws-sdk-java-v2

The official AWS SDK for Java - Version 2
Apache License 2.0
2.2k stars 853 forks source link

Fix ApacheHttpClient's handling of request bodies on DELETE, GET, HEAD & OPTIONS requests #5704

Open Xtansia opened 5 days ago

Xtansia commented 5 days ago

Motivation and Context

Though providing request bodies on these HTTP methods is uncommon, it is not disallowed by the spec, and is used in certain Elasticsearch/OpenSearch APIs. Authenticating with Amazon OpenSearch Service can be done via SigV4 and we re-use the SDK's signing logic to provide that in https://github.com/opensearch-project/opensearch-java. We've received multiple bug reports of users having trouble making certain requests using the ApacheHttpClient (https://github.com/opensearch-project/opensearch-java/issues/712, https://github.com/opensearch-project/opensearch-java/issues/521), where the client itself doesn't complain or error but silently drops the request body resulting in a mismatched signature on the server. The Netty & CRT Sdk(Async)HttpClient implementations correctly send the request body for all methods, URL Connection does as well with the exception of GET which is hardcoded to swap to POST (and doesn't support PATCH at all). As such I think it is not harmful to bring the Apache implementation in line with the other client implementations.

Modifications

Generalize the Apache HTTP request factory implementation to attach the request body entity on all HTTP methods. This matches the original implementations of the separate method classes:

Testing

Added unit tests

Screenshots (if appropriate)

Types of changes

Checklist

License