net/http: Expect: 100-continue changes behaviour if server closes request body #63152
Labels
NeedsDecision
Feedback is required from experts, contributors, and/or the community before a change can be made.
Milestone
Comments
|
After a bit more investigation, it seems that the following is happening:
The fact that the server is waiting for the request body when the client has explicitly said that it won't be sending it seems like it's probably a bug. |
|
per https://dev.golang.org/owners, we should probably ping @neild :) |
|
One other thing to note: this behaviour does not occur when the body has an explicit content length that's more than 256KiB. In that case, the code gives up without trying to read the body which causes the client to see the response immediately: https://go.dev/play/p/ajHWF161sdD |
rogpeppe
added a commit
to cue-labs/oci
that referenced
this issue
Sep 22, 2023
As outlined in [this Go issue](golang/go#63152) and [this docker registry issue](distribution/distribution#4065), failing over from single-post to post-then-put is problematic because we can't guarantee that the body won't be consumed. We could implement some logic to cache the request body until the 100-continue response arrives (I have already made a PoC to verify this), but a simpler solution, if somewhat less efficient, is always to use the post-then-put method, which doesn't require that failover.
rogpeppe
added a commit
to cue-labs/oci
that referenced
this issue
Sep 22, 2023
As outlined in [this Go issue](golang/go#63152) and [this docker registry issue](distribution/distribution#4065), failing over from single-post to post-then-put is problematic because we can't guarantee that the body won't be consumed. We could implement some logic to cache the request body until the 100-continue response arrives (I have already made a PoC to verify this), but a simpler solution, if somewhat less efficient, is always to use the post-then-put method, which doesn't require that failover.
thanm
added
the
NeedsDecision
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
What version of Go are you using (
go version)?Does this issue reproduce with the latest release?
Yes.
What operating system and processor architecture are you using (
go env)?N/A
What did you do?
https://go.dev/play/p/wwvMPANaBh4
What did you expect to see?
The same result regardless of whether the server closes the request body or not.
What did you see instead?
When the server closes the request body, the bytes of the request body are read inappropriately, probably because the server has sent a 100 Continue response.
Although http.Handler implementations should not close the body, it's not uncommon that to happen, for example here.
Replacing the
Request.Bodyfield (for example to replace it with a limited-size reader) has the same effect as closing it in this respect.The text was updated successfully, but these errors were encountered: