accept header parsing problem in org.springframework.util.parseMimeType

[naturzukunft]

I'm playing with https://activitypub.rocks and their test suite https://test.activitypub.rocks. They send accept headers like:

application/ld+json;profile=https://www.w3.org/ns/activitystreams

and that is what org.springframework.util.parseMimeType(String mimeType) didn't like! Version is spring-web-5.0.4.RELEASE. Currently i added a ContentNegotiationStrategy, that parses and convert the accept header to:

application/ld+json;profile="https://www.w3.org/ns/activitystreams"

Works for me.
So because of activity pub are the w3.org guys, I think they send the right accept-header ,-)

Thanks Fredy

2019-02-04 12:06:53 [http-nio-8080-exec-10] DEBUG o.s.s.w.u.m.MediaTypeRequestMatcher - Failed to parse MediaTypes, returning false
org.springframework.web.HttpMediaTypeNotAcceptableException: Could not parse 'Accept' header [application/ld+json;profile=https://www.w3.org/ns/activitystreams]: Invalid mime type "application/ld+json;profile=https://www.w3.org/ns/activitystreams": Invalid token character ':' in token "https://www.w3.org/ns/activitystreams"

    at org.springframework.web.accept.HeaderContentNegotiationStrategy.resolveMediaTypes(HeaderContentNegotiationStrategy.java:59)
    at org.springframework.web.accept.ContentNegotiationManager.resolveMediaTypes(ContentNegotiationManager.java:127)
    at org.springframework.security.web.util.matcher.MediaTypeRequestMatcher.matches(MediaTypeRequestMatcher.java:178)
    at org.springframework.security.web.authentication.DelegatingAuthenticationEntryPoint.commence(DelegatingAuthenticationEntryPoint.java:80)

[bclozel]

Looking at RFC 2045 section 5.1, it seems that tspecials chars are not allowed in parameter values; this includes the "/" character.

Do you have any other information stating the opposite? I tried looking at various updates of that RFC but couldn't find any specific update to parameter values in the ABNF.

[naturzukunft]

yes, i've seen this, but there is also somewhere a spec, that describes how to use profiles. I cannot find it any more ,-( Currently i found: https://www.w3.org/TR/activitypub/#retrieving-objects and in deed, they wrote The client MUST specify an Accept header with the application/ld+json; profile="https://www.w3.org/ns/activitystreams" Maybe it's a bug in their test suite !? I'm not sure, if the profile spec tells us something about using quotes.

[bclozel]

I'm closing this issue for now, please update us if you've found new information about this. From my point of view, their test suite might just be relying on a lenient server, or they might be looking at that header as a String and not bother parsing the header as a media type.

Thanks!