search

ring-clojure / ring

Clojure HTTP server abstraction
MIT License
3.73k stars 518 forks source link

How to change UriCompliance mode #490

Closed tomoharu-fujita closed 6 months ago

tomoharu-fujita commented 6 months ago

With Jetty 11, there are cases where a request URI that used to respond validly will now respond with a 400 Bad Request.

If UriCompliance in HttpConfiguration can be set to LEGACY I think it would be possible to make jetty's URI judgment behavior the same as the previous version if UriCompliance mode in HttpConfiguration set to LEGACY, Is it possible to have such an option in ring-jetty-adapter?

If there is some way to change the HttpConfiguration setting in the :configurator setting, I'm thinking that would be fine also. I thought about it for a while but could not think of a way to achieve.

weavejester commented 6 months ago

Can you give more details about what request URIs are responded to with a 400 Bad Request response?

I haven't checked, but you should be able to use a configurator function like:

(fn [server]
  (let [connector (-> server .getConnectors first)
        factory   (.getDefaultConnectionFactory connector)
        config    (.getHttpConfiguration factory)]
    (.setUriCompliance config UriCompliance/LEGACY)))

Not that this assumes that you haven't set :ssl? to true in your Jetty options. If you have, there will be two Connectors (one for HTTP, one for HTTPS), and the SSL connector will (I believe) have two ConnectionFactorys (one for SSL, one for HTTP). The configurator function therefore becomes a little more complex as you'll need to find the HttpConnectionFactory for both Connectors.

tomoharu-fujita commented 6 months ago

Thank you James.

It certainly looks like that configurator setting will work. I'll give it a try.

The cases where the 400 response occurs are, for example, when the URI contains '//'. ex) http://example.com/path/to//

Most of the cases are caused by user's mistake in specifying href, but I would like to avoid that a link that used to work suddenly becomes a 400 response.