Black Lives Matter. Support the Equal Justice Initiative.

Source file src/net/http/client.go

Documentation: net/http

     1  // Copyright 2009 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  // HTTP client. See RFC 7230 through 7235.
     6  //
     7  // This is the high-level Client interface.
     8  // The low-level implementation is in transport.go.
     9  
    10  package http
    11  
    12  import (
    13  	"context"
    14  	"crypto/tls"
    15  	"encoding/base64"
    16  	"errors"
    17  	"fmt"
    18  	"io"
    19  	"io/ioutil"
    20  	"log"
    21  	"net/url"
    22  	"reflect"
    23  	"sort"
    24  	"strings"
    25  	"sync"
    26  	"time"
    27  )
    28  
    29  // A Client is an HTTP client. Its zero value (DefaultClient) is a
    30  // usable client that uses DefaultTransport.
    31  //
    32  // The Client's Transport typically has internal state (cached TCP
    33  // connections), so Clients should be reused instead of created as
    34  // needed. Clients are safe for concurrent use by multiple goroutines.
    35  //
    36  // A Client is higher-level than a RoundTripper (such as Transport)
    37  // and additionally handles HTTP details such as cookies and
    38  // redirects.
    39  //
    40  // When following redirects, the Client will forward all headers set on the
    41  // initial Request except:
    42  //
    43  // • when forwarding sensitive headers like "Authorization",
    44  // "WWW-Authenticate", and "Cookie" to untrusted targets.
    45  // These headers will be ignored when following a redirect to a domain
    46  // that is not a subdomain match or exact match of the initial domain.
    47  // For example, a redirect from "foo.com" to either "foo.com" or "sub.foo.com"
    48  // will forward the sensitive headers, but a redirect to "bar.com" will not.
    49  //
    50  // • when forwarding the "Cookie" header with a non-nil cookie Jar.
    51  // Since each redirect may mutate the state of the cookie jar,
    52  // a redirect may possibly alter a cookie set in the initial request.
    53  // When forwarding the "Cookie" header, any mutated cookies will be omitted,
    54  // with the expectation that the Jar will insert those mutated cookies
    55  // with the updated values (assuming the origin matches).
    56  // If Jar is nil, the initial cookies are forwarded without change.
    57  //
    58  type Client struct {
    59  	// Transport specifies the mechanism by which individual
    60  	// HTTP requests are made.
    61  	// If nil, DefaultTransport is used.
    62  	Transport RoundTripper
    63  
    64  	// CheckRedirect specifies the policy for handling redirects.
    65  	// If CheckRedirect is not nil, the client calls it before
    66  	// following an HTTP redirect. The arguments req and via are
    67  	// the upcoming request and the requests made already, oldest
    68  	// first. If CheckRedirect returns an error, the Client's Get
    69  	// method returns both the previous Response (with its Body
    70  	// closed) and CheckRedirect's error (wrapped in a url.Error)
    71  	// instead of issuing the Request req.
    72  	// As a special case, if CheckRedirect returns ErrUseLastResponse,
    73  	// then the most recent response is returned with its body
    74  	// unclosed, along with a nil error.
    75  	//
    76  	// If CheckRedirect is nil, the Client uses its default policy,
    77  	// which is to stop after 10 consecutive requests.
    78  	CheckRedirect func(req *Request, via []*Request) error
    79  
    80  	// Jar specifies the cookie jar.
    81  	//
    82  	// The Jar is used to insert relevant cookies into every
    83  	// outbound Request and is updated with the cookie values
    84  	// of every inbound Response. The Jar is consulted for every
    85  	// redirect that the Client follows.
    86  	//
    87  	// If Jar is nil, cookies are only sent if they are explicitly
    88  	// set on the Request.
    89  	Jar CookieJar
    90  
    91  	// Timeout specifies a time limit for requests made by this
    92  	// Client. The timeout includes connection time, any
    93  	// redirects, and reading the response body. The timer remains
    94  	// running after Get, Head, Post, or Do return and will
    95  	// interrupt reading of the Response.Body.
    96  	//
    97  	// A Timeout of zero means no timeout.
    98  	//
    99  	// The Client cancels requests to the underlying Transport
   100  	// as if the Request's Context ended.
   101  	//
   102  	// For compatibility, the Client will also use the deprecated
   103  	// CancelRequest method on Transport if found. New
   104  	// RoundTripper implementations should use the Request's Context
   105  	// for cancellation instead of implementing CancelRequest.
   106  	Timeout time.Duration
   107  }
   108  
   109  // DefaultClient is the default Client and is used by Get, Head, and Post.
   110  var DefaultClient = &Client{}
   111  
   112  // RoundTripper is an interface representing the ability to execute a
   113  // single HTTP transaction, obtaining the Response for a given Request.
   114  //
   115  // A RoundTripper must be safe for concurrent use by multiple
   116  // goroutines.
   117  type RoundTripper interface {
   118  	// RoundTrip executes a single HTTP transaction, returning
   119  	// a Response for the provided Request.
   120  	//
   121  	// RoundTrip should not attempt to interpret the response. In
   122  	// particular, RoundTrip must return err == nil if it obtained
   123  	// a response, regardless of the response's HTTP status code.
   124  	// A non-nil err should be reserved for failure to obtain a
   125  	// response. Similarly, RoundTrip should not attempt to
   126  	// handle higher-level protocol details such as redirects,
   127  	// authentication, or cookies.
   128  	//
   129  	// RoundTrip should not modify the request, except for
   130  	// consuming and closing the Request's Body. RoundTrip may
   131  	// read fields of the request in a separate goroutine. Callers
   132  	// should not mutate or reuse the request until the Response's
   133  	// Body has been closed.
   134  	//
   135  	// RoundTrip must always close the body, including on errors,
   136  	// but depending on the implementation may do so in a separate
   137  	// goroutine even after RoundTrip returns. This means that
   138  	// callers wanting to reuse the body for subsequent requests
   139  	// must arrange to wait for the Close call before doing so.
   140  	//
   141  	// The Request's URL and Header fields must be initialized.
   142  	RoundTrip(*Request) (*Response, error)
   143  }
   144  
   145  // refererForURL returns a referer without any authentication info or
   146  // an empty string if lastReq scheme is https and newReq scheme is http.
   147  func refererForURL(lastReq, newReq *url.URL) string {
   148  	// https://tools.ietf.org/html/rfc7231#section-5.5.2
   149  	//   "Clients SHOULD NOT include a Referer header field in a
   150  	//    (non-secure) HTTP request if the referring page was
   151  	//    transferred with a secure protocol."
   152  	if lastReq.Scheme == "https" && newReq.Scheme == "http" {
   153  		return ""
   154  	}
   155  	referer := lastReq.String()
   156  	if lastReq.User != nil {
   157  		// This is not very efficient, but is the best we can
   158  		// do without:
   159  		// - introducing a new method on URL
   160  		// - creating a race condition
   161  		// - copying the URL struct manually, which would cause
   162  		//   maintenance problems down the line
   163  		auth := lastReq.User.String() + "@"
   164  		referer = strings.Replace(referer, auth, "", 1)
   165  	}
   166  	return referer
   167  }
   168  
   169  // didTimeout is non-nil only if err != nil.
   170  func (c *Client) send(req *Request, deadline time.Time) (resp *Response, didTimeout func() bool, err error) {
   171  	if c.Jar != nil {
   172  		for _, cookie := range c.Jar.Cookies(req.URL) {
   173  			req.AddCookie(cookie)
   174  		}
   175  	}
   176  	resp, didTimeout, err = send(req, c.transport(), deadline)
   177  	if err != nil {
   178  		return nil, didTimeout, err
   179  	}
   180  	if c.Jar != nil {
   181  		if rc := resp.Cookies(); len(rc) > 0 {
   182  			c.Jar.SetCookies(req.URL, rc)
   183  		}
   184  	}
   185  	return resp, nil, nil
   186  }
   187  
   188  func (c *Client) deadline() time.Time {
   189  	if c.Timeout > 0 {
   190  		return time.Now().Add(c.Timeout)
   191  	}
   192  	return time.Time{}
   193  }
   194  
   195  func (c *Client) transport() RoundTripper {
   196  	if c.Transport != nil {
   197  		return c.Transport
   198  	}
   199  	return DefaultTransport
   200  }
   201  
   202  // send issues an HTTP request.
   203  // Caller should close resp.Body when done reading from it.
   204  func send(ireq *Request, rt RoundTripper, deadline time.Time) (resp *Response, didTimeout func() bool, err error) {
   205  	req := ireq // req is either the original request, or a modified fork
   206  
   207  	if rt == nil {
   208  		req.closeBody()
   209  		return nil, alwaysFalse, errors.New("http: no Client.Transport or DefaultTransport")
   210  	}
   211  
   212  	if req.URL == nil {
   213  		req.closeBody()
   214  		return nil, alwaysFalse, errors.New("http: nil Request.URL")
   215  	}
   216  
   217  	if req.RequestURI != "" {
   218  		req.closeBody()
   219  		return nil, alwaysFalse, errors.New("http: Request.RequestURI can't be set in client requests")
   220  	}
   221  
   222  	// forkReq forks req into a shallow clone of ireq the first
   223  	// time it's called.
   224  	forkReq := func() {
   225  		if ireq == req {
   226  			req = new(Request)
   227  			*req = *ireq // shallow clone
   228  		}
   229  	}
   230  
   231  	// Most the callers of send (Get, Post, et al) don't need
   232  	// Headers, leaving it uninitialized. We guarantee to the
   233  	// Transport that this has been initialized, though.
   234  	if req.Header == nil {
   235  		forkReq()
   236  		req.Header = make(Header)
   237  	}
   238  
   239  	if u := req.URL.User; u != nil && req.Header.Get("Authorization") == "" {
   240  		username := u.Username()
   241  		password, _ := u.Password()
   242  		forkReq()
   243  		req.Header = cloneOrMakeHeader(ireq.Header)
   244  		req.Header.Set("Authorization", "Basic "+basicAuth(username, password))
   245  	}
   246  
   247  	if !deadline.IsZero() {
   248  		forkReq()
   249  	}
   250  	stopTimer, didTimeout := setRequestCancel(req, rt, deadline)
   251  
   252  	resp, err = rt.RoundTrip(req)
   253  	if err != nil {
   254  		stopTimer()
   255  		if resp != nil {
   256  			log.Printf("RoundTripper returned a response & error; ignoring response")
   257  		}
   258  		if tlsErr, ok := err.(tls.RecordHeaderError); ok {
   259  			// If we get a bad TLS record header, check to see if the
   260  			// response looks like HTTP and give a more helpful error.
   261  			// See golang.org/issue/11111.
   262  			if string(tlsErr.RecordHeader[:]) == "HTTP/" {
   263  				err = errors.New("http: server gave HTTP response to HTTPS client")
   264  			}
   265  		}
   266  		return nil, didTimeout, err
   267  	}
   268  	if resp == nil {
   269  		return nil, didTimeout, fmt.Errorf("http: RoundTripper implementation (%T) returned a nil *Response with a nil error", rt)
   270  	}
   271  	if resp.Body == nil {
   272  		// The documentation on the Body field says “The http Client and Transport
   273  		// guarantee that Body is always non-nil, even on responses without a body
   274  		// or responses with a zero-length body.” Unfortunately, we didn't document
   275  		// that same constraint for arbitrary RoundTripper implementations, and
   276  		// RoundTripper implementations in the wild (mostly in tests) assume that
   277  		// they can use a nil Body to mean an empty one (similar to Request.Body).
   278  		// (See https://golang.org/issue/38095.)
   279  		//
   280  		// If the ContentLength allows the Body to be empty, fill in an empty one
   281  		// here to ensure that it is non-nil.
   282  		if resp.ContentLength > 0 && req.Method != "HEAD" {
   283  			return nil, didTimeout, fmt.Errorf("http: RoundTripper implementation (%T) returned a *Response with content length %d but a nil Body", rt, resp.ContentLength)
   284  		}
   285  		resp.Body = ioutil.NopCloser(strings.NewReader(""))
   286  	}
   287  	if !deadline.IsZero() {
   288  		resp.Body = &cancelTimerBody{
   289  			stop:          stopTimer,
   290  			rc:            resp.Body,
   291  			reqDidTimeout: didTimeout,
   292  		}
   293  	}
   294  	return resp, nil, nil
   295  }
   296  
   297  // timeBeforeContextDeadline reports whether the non-zero Time t is
   298  // before ctx's deadline, if any. If ctx does not have a deadline, it
   299  // always reports true (the deadline is considered infinite).
   300  func timeBeforeContextDeadline(t time.Time, ctx context.Context) bool {
   301  	d, ok := ctx.Deadline()
   302  	if !ok {
   303  		return true
   304  	}
   305  	return t.Before(d)
   306  }
   307  
   308  // knownRoundTripperImpl reports whether rt is a RoundTripper that's
   309  // maintained by the Go team and known to implement the latest
   310  // optional semantics (notably contexts). The Request is used
   311  // to check whether this particular request is using an alternate protocol,
   312  // in which case we need to check the RoundTripper for that protocol.
   313  func knownRoundTripperImpl(rt RoundTripper, req *Request) bool {
   314  	switch t := rt.(type) {
   315  	case *Transport:
   316  		if altRT := t.alternateRoundTripper(req); altRT != nil {
   317  			return knownRoundTripperImpl(altRT, req)
   318  		}
   319  		return true
   320  	case *http2Transport, http2noDialH2RoundTripper:
   321  		return true
   322  	}
   323  	// There's a very minor chance of a false positive with this.
   324  	// Insted of detecting our golang.org/x/net/http2.Transport,
   325  	// it might detect a Transport type in a different http2
   326  	// package. But I know of none, and the only problem would be
   327  	// some temporarily leaked goroutines if the transport didn't
   328  	// support contexts. So this is a good enough heuristic:
   329  	if reflect.TypeOf(rt).String() == "*http2.Transport" {
   330  		return true
   331  	}
   332  	return false
   333  }
   334  
   335  // setRequestCancel sets req.Cancel and adds a deadline context to req
   336  // if deadline is non-zero. The RoundTripper's type is used to
   337  // determine whether the legacy CancelRequest behavior should be used.
   338  //
   339  // As background, there are three ways to cancel a request:
   340  // First was Transport.CancelRequest. (deprecated)
   341  // Second was Request.Cancel.
   342  // Third was Request.Context.
   343  // This function populates the second and third, and uses the first if it really needs to.
   344  func setRequestCancel(req *Request, rt RoundTripper, deadline time.Time) (stopTimer func(), didTimeout func() bool) {
   345  	if deadline.IsZero() {
   346  		return nop, alwaysFalse
   347  	}
   348  	knownTransport := knownRoundTripperImpl(rt, req)
   349  	oldCtx := req.Context()
   350  
   351  	if req.Cancel == nil && knownTransport {
   352  		// If they already had a Request.Context that's
   353  		// expiring sooner, do nothing:
   354  		if !timeBeforeContextDeadline(deadline, oldCtx) {
   355  			return nop, alwaysFalse
   356  		}
   357  
   358  		var cancelCtx func()
   359  		req.ctx, cancelCtx = context.WithDeadline(oldCtx, deadline)
   360  		return cancelCtx, func() bool { return time.Now().After(deadline) }
   361  	}
   362  	initialReqCancel := req.Cancel // the user's original Request.Cancel, if any
   363  
   364  	var cancelCtx func()
   365  	if oldCtx := req.Context(); timeBeforeContextDeadline(deadline, oldCtx) {
   366  		req.ctx, cancelCtx = context.WithDeadline(oldCtx, deadline)
   367  	}
   368  
   369  	cancel := make(chan struct{})
   370  	req.Cancel = cancel
   371  
   372  	doCancel := func() {
   373  		// The second way in the func comment above:
   374  		close(cancel)
   375  		// The first way, used only for RoundTripper
   376  		// implementations written before Go 1.5 or Go 1.6.
   377  		type canceler interface{ CancelRequest(*Request) }
   378  		if v, ok := rt.(canceler); ok {
   379  			v.CancelRequest(req)
   380  		}
   381  	}
   382  
   383  	stopTimerCh := make(chan struct{})
   384  	var once sync.Once
   385  	stopTimer = func() {
   386  		once.Do(func() {
   387  			close(stopTimerCh)
   388  			if cancelCtx != nil {
   389  				cancelCtx()
   390  			}
   391  		})
   392  	}
   393  
   394  	timer := time.NewTimer(time.Until(deadline))
   395  	var timedOut atomicBool
   396  
   397  	go func() {
   398  		select {
   399  		case <-initialReqCancel:
   400  			doCancel()
   401  			timer.Stop()
   402  		case <-timer.C:
   403  			timedOut.setTrue()
   404  			doCancel()
   405  		case <-stopTimerCh:
   406  			timer.Stop()
   407  		}
   408  	}()
   409  
   410  	return stopTimer, timedOut.isSet
   411  }
   412  
   413  // See 2 (end of page 4) https://www.ietf.org/rfc/rfc2617.txt
   414  // "To receive authorization, the client sends the userid and password,
   415  // separated by a single colon (":") character, within a base64
   416  // encoded string in the credentials."
   417  // It is not meant to be urlencoded.
   418  func basicAuth(username, password string) string {
   419  	auth := username + ":" + password
   420  	return base64.StdEncoding.EncodeToString([]byte(auth))
   421  }
   422  
   423  // Get issues a GET to the specified URL. If the response is one of
   424  // the following redirect codes, Get follows the redirect, up to a
   425  // maximum of 10 redirects:
   426  //
   427  //    301 (Moved Permanently)
   428  //    302 (Found)
   429  //    303 (See Other)
   430  //    307 (Temporary Redirect)
   431  //    308 (Permanent Redirect)
   432  //
   433  // An error is returned if there were too many redirects or if there
   434  // was an HTTP protocol error. A non-2xx response doesn't cause an
   435  // error. Any returned error will be of type *url.Error. The url.Error
   436  // value's Timeout method will report true if request timed out or was
   437  // canceled.
   438  //
   439  // When err is nil, resp always contains a non-nil resp.Body.
   440  // Caller should close resp.Body when done reading from it.
   441  //
   442  // Get is a wrapper around DefaultClient.Get.
   443  //
   444  // To make a request with custom headers, use NewRequest and
   445  // DefaultClient.Do.
   446  func Get(url string) (resp *Response, err error) {
   447  	return DefaultClient.Get(url)
   448  }
   449  
   450  // Get issues a GET to the specified URL. If the response is one of the
   451  // following redirect codes, Get follows the redirect after calling the
   452  // Client's CheckRedirect function:
   453  //
   454  //    301 (Moved Permanently)
   455  //    302 (Found)
   456  //    303 (See Other)
   457  //    307 (Temporary Redirect)
   458  //    308 (Permanent Redirect)
   459  //
   460  // An error is returned if the Client's CheckRedirect function fails
   461  // or if there was an HTTP protocol error. A non-2xx response doesn't
   462  // cause an error. Any returned error will be of type *url.Error. The
   463  // url.Error value's Timeout method will report true if the request
   464  // timed out.
   465  //
   466  // When err is nil, resp always contains a non-nil resp.Body.
   467  // Caller should close resp.Body when done reading from it.
   468  //
   469  // To make a request with custom headers, use NewRequest and Client.Do.
   470  func (c *Client) Get(url string) (resp *Response, err error) {
   471  	req, err := NewRequest("GET", url, nil)
   472  	if err != nil {
   473  		return nil, err
   474  	}
   475  	return c.Do(req)
   476  }
   477  
   478  func alwaysFalse() bool { return false }
   479  
   480  // ErrUseLastResponse can be returned by Client.CheckRedirect hooks to
   481  // control how redirects are processed. If returned, the next request
   482  // is not sent and the most recent response is returned with its body
   483  // unclosed.
   484  var ErrUseLastResponse = errors.New("net/http: use last response")
   485  
   486  // checkRedirect calls either the user's configured CheckRedirect
   487  // function, or the default.
   488  func (c *Client) checkRedirect(req *Request, via []*Request) error {
   489  	fn := c.CheckRedirect
   490  	if fn == nil {
   491  		fn = defaultCheckRedirect
   492  	}
   493  	return fn(req, via)
   494  }
   495  
   496  // redirectBehavior describes what should happen when the
   497  // client encounters a 3xx status code from the server
   498  func redirectBehavior(reqMethod string, resp *Response, ireq *Request) (redirectMethod string, shouldRedirect, includeBody bool) {
   499  	switch resp.StatusCode {
   500  	case 301, 302, 303:
   501  		redirectMethod = reqMethod
   502  		shouldRedirect = true
   503  		includeBody = false
   504  
   505  		// RFC 2616 allowed automatic redirection only with GET and
   506  		// HEAD requests. RFC 7231 lifts this restriction, but we still
   507  		// restrict other methods to GET to maintain compatibility.
   508  		// See Issue 18570.
   509  		if reqMethod != "GET" && reqMethod != "HEAD" {
   510  			redirectMethod = "GET"
   511  		}
   512  	case 307, 308:
   513  		redirectMethod = reqMethod
   514  		shouldRedirect = true
   515  		includeBody = true
   516  
   517  		// Treat 307 and 308 specially, since they're new in
   518  		// Go 1.8, and they also require re-sending the request body.
   519  		if resp.Header.Get("Location") == "" {
   520  			// 308s have been observed in the wild being served
   521  			// without Location headers. Since Go 1.7 and earlier
   522  			// didn't follow these codes, just stop here instead
   523  			// of returning an error.
   524  			// See Issue 17773.
   525  			shouldRedirect = false
   526  			break
   527  		}
   528  		if ireq.GetBody == nil && ireq.outgoingLength() != 0 {
   529  			// We had a request body, and 307/308 require
   530  			// re-sending it, but GetBody is not defined. So just
   531  			// return this response to the user instead of an
   532  			// error, like we did in Go 1.7 and earlier.
   533  			shouldRedirect = false
   534  		}
   535  	}
   536  	return redirectMethod, shouldRedirect, includeBody
   537  }
   538  
   539  // urlErrorOp returns the (*url.Error).Op value to use for the
   540  // provided (*Request).Method value.
   541  func urlErrorOp(method string) string {
   542  	if method == "" {
   543  		return "Get"
   544  	}
   545  	return method[:1] + strings.ToLower(method[1:])
   546  }
   547  
   548  // Do sends an HTTP request and returns an HTTP response, following
   549  // policy (such as redirects, cookies, auth) as configured on the
   550  // client.
   551  //
   552  // An error is returned if caused by client policy (such as
   553  // CheckRedirect), or failure to speak HTTP (such as a network
   554  // connectivity problem). A non-2xx status code doesn't cause an
   555  // error.
   556  //
   557  // If the returned error is nil, the Response will contain a non-nil
   558  // Body which the user is expected to close. If the Body is not both
   559  // read to EOF and closed, the Client's underlying RoundTripper
   560  // (typically Transport) may not be able to re-use a persistent TCP
   561  // connection to the server for a subsequent "keep-alive" request.
   562  //
   563  // The request Body, if non-nil, will be closed by the underlying
   564  // Transport, even on errors.
   565  //
   566  // On error, any Response can be ignored. A non-nil Response with a
   567  // non-nil error only occurs when CheckRedirect fails, and even then
   568  // the returned Response.Body is already closed.
   569  //
   570  // Generally Get, Post, or PostForm will be used instead of Do.
   571  //
   572  // If the server replies with a redirect, the Client first uses the
   573  // CheckRedirect function to determine whether the redirect should be
   574  // followed. If permitted, a 301, 302, or 303 redirect causes
   575  // subsequent requests to use HTTP method GET
   576  // (or HEAD if the original request was HEAD), with no body.
   577  // A 307 or 308 redirect preserves the original HTTP method and body,
   578  // provided that the Request.GetBody function is defined.
   579  // The NewRequest function automatically sets GetBody for common
   580  // standard library body types.
   581  //
   582  // Any returned error will be of type *url.Error. The url.Error
   583  // value's Timeout method will report true if request timed out or was
   584  // canceled.
   585  func (c *Client) Do(req *Request) (*Response, error) {
   586  	return c.do(req)
   587  }
   588  
   589  var testHookClientDoResult func(retres *Response, reterr error)
   590  
   591  func (c *Client) do(req *Request) (retres *Response, reterr error) {
   592  	if testHookClientDoResult != nil {
   593  		defer func() { testHookClientDoResult(retres, reterr) }()
   594  	}
   595  	if req.URL == nil {
   596  		req.closeBody()
   597  		return nil, &url.Error{
   598  			Op:  urlErrorOp(req.Method),
   599  			Err: errors.New("http: nil Request.URL"),
   600  		}
   601  	}
   602  
   603  	var (
   604  		deadline      = c.deadline()
   605  		reqs          []*Request
   606  		resp          *Response
   607  		copyHeaders   = c.makeHeadersCopier(req)
   608  		reqBodyClosed = false // have we closed the current req.Body?
   609  
   610  		// Redirect behavior:
   611  		redirectMethod string
   612  		includeBody    bool
   613  	)
   614  	uerr := func(err error) error {
   615  		// the body may have been closed already by c.send()
   616  		if !reqBodyClosed {
   617  			req.closeBody()
   618  		}
   619  		var urlStr string
   620  		if resp != nil && resp.Request != nil {
   621  			urlStr = stripPassword(resp.Request.URL)
   622  		} else {
   623  			urlStr = stripPassword(req.URL)
   624  		}
   625  		return &url.Error{
   626  			Op:  urlErrorOp(reqs[0].Method),
   627  			URL: urlStr,
   628  			Err: err,
   629  		}
   630  	}
   631  	for {
   632  		// For all but the first request, create the next
   633  		// request hop and replace req.
   634  		if len(reqs) > 0 {
   635  			loc := resp.Header.Get("Location")
   636  			if loc == "" {
   637  				resp.closeBody()
   638  				return nil, uerr(fmt.Errorf("%d response missing Location header", resp.StatusCode))
   639  			}
   640  			u, err := req.URL.Parse(loc)
   641  			if err != nil {
   642  				resp.closeBody()
   643  				return nil, uerr(fmt.Errorf("failed to parse Location header %q: %v", loc, err))
   644  			}
   645  			host := ""
   646  			if req.Host != "" && req.Host != req.URL.Host {
   647  				// If the caller specified a custom Host header and the
   648  				// redirect location is relative, preserve the Host header
   649  				// through the redirect. See issue #22233.
   650  				if u, _ := url.Parse(loc); u != nil && !u.IsAbs() {
   651  					host = req.Host
   652  				}
   653  			}
   654  			ireq := reqs[0]
   655  			req = &Request{
   656  				Method:   redirectMethod,
   657  				Response: resp,
   658  				URL:      u,
   659  				Header:   make(Header),
   660  				Host:     host,
   661  				Cancel:   ireq.Cancel,
   662  				ctx:      ireq.ctx,
   663  			}
   664  			if includeBody && ireq.GetBody != nil {
   665  				req.Body, err = ireq.GetBody()
   666  				if err != nil {
   667  					resp.closeBody()
   668  					return nil, uerr(err)
   669  				}
   670  				req.ContentLength = ireq.ContentLength
   671  			}
   672  
   673  			// Copy original headers before setting the Referer,
   674  			// in case the user set Referer on their first request.
   675  			// If they really want to override, they can do it in
   676  			// their CheckRedirect func.
   677  			copyHeaders(req)
   678  
   679  			// Add the Referer header from the most recent
   680  			// request URL to the new one, if it's not https->http:
   681  			if ref := refererForURL(reqs[len(reqs)-1].URL, req.URL); ref != "" {
   682  				req.Header.Set("Referer", ref)
   683  			}
   684  			err = c.checkRedirect(req, reqs)
   685  
   686  			// Sentinel error to let users select the
   687  			// previous response, without closing its
   688  			// body. See Issue 10069.
   689  			if err == ErrUseLastResponse {
   690  				return resp, nil
   691  			}
   692  
   693  			// Close the previous response's body. But
   694  			// read at least some of the body so if it's
   695  			// small the underlying TCP connection will be
   696  			// re-used. No need to check for errors: if it
   697  			// fails, the Transport won't reuse it anyway.
   698  			const maxBodySlurpSize = 2 << 10
   699  			if resp.ContentLength == -1 || resp.ContentLength <= maxBodySlurpSize {
   700  				io.CopyN(ioutil.Discard, resp.Body, maxBodySlurpSize)
   701  			}
   702  			resp.Body.Close()
   703  
   704  			if err != nil {
   705  				// Special case for Go 1 compatibility: return both the response
   706  				// and an error if the CheckRedirect function failed.
   707  				// See https://golang.org/issue/3795
   708  				// The resp.Body has already been closed.
   709  				ue := uerr(err)
   710  				ue.(*url.Error).URL = loc
   711  				return resp, ue
   712  			}
   713  		}
   714  
   715  		reqs = append(reqs, req)
   716  		var err error
   717  		var didTimeout func() bool
   718  		if resp, didTimeout, err = c.send(req, deadline); err != nil {
   719  			// c.send() always closes req.Body
   720  			reqBodyClosed = true
   721  			if !deadline.IsZero() && didTimeout() {
   722  				err = &httpError{
   723  					// TODO: early in cycle: s/Client.Timeout exceeded/timeout or context cancellation/
   724  					err:     err.Error() + " (Client.Timeout exceeded while awaiting headers)",
   725  					timeout: true,
   726  				}
   727  			}
   728  			return nil, uerr(err)
   729  		}
   730  
   731  		var shouldRedirect bool
   732  		redirectMethod, shouldRedirect, includeBody = redirectBehavior(req.Method, resp, reqs[0])
   733  		if !shouldRedirect {
   734  			return resp, nil
   735  		}
   736  
   737  		req.closeBody()
   738  	}
   739  }
   740  
   741  // makeHeadersCopier makes a function that copies headers from the
   742  // initial Request, ireq. For every redirect, this function must be called
   743  // so that it can copy headers into the upcoming Request.
   744  func (c *Client) makeHeadersCopier(ireq *Request) func(*Request) {
   745  	// The headers to copy are from the very initial request.
   746  	// We use a closured callback to keep a reference to these original headers.
   747  	var (
   748  		ireqhdr  = cloneOrMakeHeader(ireq.Header)
   749  		icookies map[string][]*Cookie
   750  	)
   751  	if c.Jar != nil && ireq.Header.Get("Cookie") != "" {
   752  		icookies = make(map[string][]*Cookie)
   753  		for _, c := range ireq.Cookies() {
   754  			icookies[c.Name] = append(icookies[c.Name], c)
   755  		}
   756  	}
   757  
   758  	preq := ireq // The previous request
   759  	return func(req *Request) {
   760  		// If Jar is present and there was some initial cookies provided
   761  		// via the request header, then we may need to alter the initial
   762  		// cookies as we follow redirects since each redirect may end up
   763  		// modifying a pre-existing cookie.
   764  		//
   765  		// Since cookies already set in the request header do not contain
   766  		// information about the original domain and path, the logic below
   767  		// assumes any new set cookies override the original cookie
   768  		// regardless of domain or path.
   769  		//
   770  		// See https://golang.org/issue/17494
   771  		if c.Jar != nil && icookies != nil {
   772  			var changed bool
   773  			resp := req.Response // The response that caused the upcoming redirect
   774  			for _, c := range resp.Cookies() {
   775  				if _, ok := icookies[c.Name]; ok {
   776  					delete(icookies, c.Name)
   777  					changed = true
   778  				}
   779  			}
   780  			if changed {
   781  				ireqhdr.Del("Cookie")
   782  				var ss []string
   783  				for _, cs := range icookies {
   784  					for _, c := range cs {
   785  						ss = append(ss, c.Name+"="+c.Value)
   786  					}
   787  				}
   788  				sort.Strings(ss) // Ensure deterministic headers
   789  				ireqhdr.Set("Cookie", strings.Join(ss, "; "))
   790  			}
   791  		}
   792  
   793  		// Copy the initial request's Header values
   794  		// (at least the safe ones).
   795  		for k, vv := range ireqhdr {
   796  			if shouldCopyHeaderOnRedirect(k, preq.URL, req.URL) {
   797  				req.Header[k] = vv
   798  			}
   799  		}
   800  
   801  		preq = req // Update previous Request with the current request
   802  	}
   803  }
   804  
   805  func defaultCheckRedirect(req *Request, via []*Request) error {
   806  	if len(via) >= 10 {
   807  		return errors.New("stopped after 10 redirects")
   808  	}
   809  	return nil
   810  }
   811  
   812  // Post issues a POST to the specified URL.
   813  //
   814  // Caller should close resp.Body when done reading from it.
   815  //
   816  // If the provided body is an io.Closer, it is closed after the
   817  // request.
   818  //
   819  // Post is a wrapper around DefaultClient.Post.
   820  //
   821  // To set custom headers, use NewRequest and DefaultClient.Do.
   822  //
   823  // See the Client.Do method documentation for details on how redirects
   824  // are handled.
   825  func Post(url, contentType string, body io.Reader) (resp *Response, err error) {
   826  	return DefaultClient.Post(url, contentType, body)
   827  }
   828  
   829  // Post issues a POST to the specified URL.
   830  //
   831  // Caller should close resp.Body when done reading from it.
   832  //
   833  // If the provided body is an io.Closer, it is closed after the
   834  // request.
   835  //
   836  // To set custom headers, use NewRequest and Client.Do.
   837  //
   838  // See the Client.Do method documentation for details on how redirects
   839  // are handled.
   840  func (c *Client) Post(url, contentType string, body io.Reader) (resp *Response, err error) {
   841  	req, err := NewRequest("POST", url, body)
   842  	if err != nil {
   843  		return nil, err
   844  	}
   845  	req.Header.Set("Content-Type", contentType)
   846  	return c.Do(req)
   847  }
   848  
   849  // PostForm issues a POST to the specified URL, with data's keys and
   850  // values URL-encoded as the request body.
   851  //
   852  // The Content-Type header is set to application/x-www-form-urlencoded.
   853  // To set other headers, use NewRequest and DefaultClient.Do.
   854  //
   855  // When err is nil, resp always contains a non-nil resp.Body.
   856  // Caller should close resp.Body when done reading from it.
   857  //
   858  // PostForm is a wrapper around DefaultClient.PostForm.
   859  //
   860  // See the Client.Do method documentation for details on how redirects
   861  // are handled.
   862  func PostForm(url string, data url.Values) (resp *Response, err error) {
   863  	return DefaultClient.PostForm(url, data)
   864  }
   865  
   866  // PostForm issues a POST to the specified URL,
   867  // with data's keys and values URL-encoded as the request body.
   868  //
   869  // The Content-Type header is set to application/x-www-form-urlencoded.
   870  // To set other headers, use NewRequest and Client.Do.
   871  //
   872  // When err is nil, resp always contains a non-nil resp.Body.
   873  // Caller should close resp.Body when done reading from it.
   874  //
   875  // See the Client.Do method documentation for details on how redirects
   876  // are handled.
   877  func (c *Client) PostForm(url string, data url.Values) (resp *Response, err error) {
   878  	return c.Post(url, "application/x-www-form-urlencoded", strings.NewReader(data.Encode()))
   879  }
   880  
   881  // Head issues a HEAD to the specified URL. If the response is one of
   882  // the following redirect codes, Head follows the redirect, up to a
   883  // maximum of 10 redirects:
   884  //
   885  //    301 (Moved Permanently)
   886  //    302 (Found)
   887  //    303 (See Other)
   888  //    307 (Temporary Redirect)
   889  //    308 (Permanent Redirect)
   890  //
   891  // Head is a wrapper around DefaultClient.Head
   892  func Head(url string) (resp *Response, err error) {
   893  	return DefaultClient.Head(url)
   894  }
   895  
   896  // Head issues a HEAD to the specified URL. If the response is one of the
   897  // following redirect codes, Head follows the redirect after calling the
   898  // Client's CheckRedirect function:
   899  //
   900  //    301 (Moved Permanently)
   901  //    302 (Found)
   902  //    303 (See Other)
   903  //    307 (Temporary Redirect)
   904  //    308 (Permanent Redirect)
   905  func (c *Client) Head(url string) (resp *Response, err error) {
   906  	req, err := NewRequest("HEAD", url, nil)
   907  	if err != nil {
   908  		return nil, err
   909  	}
   910  	return c.Do(req)
   911  }
   912  
   913  // CloseIdleConnections closes any connections on its Transport which
   914  // were previously connected from previous requests but are now
   915  // sitting idle in a "keep-alive" state. It does not interrupt any
   916  // connections currently in use.
   917  //
   918  // If the Client's Transport does not have a CloseIdleConnections method
   919  // then this method does nothing.
   920  func (c *Client) CloseIdleConnections() {
   921  	type closeIdler interface {
   922  		CloseIdleConnections()
   923  	}
   924  	if tr, ok := c.transport().(closeIdler); ok {
   925  		tr.CloseIdleConnections()
   926  	}
   927  }
   928  
   929  // cancelTimerBody is an io.ReadCloser that wraps rc with two features:
   930  // 1) on Read error or close, the stop func is called.
   931  // 2) On Read failure, if reqDidTimeout is true, the error is wrapped and
   932  //    marked as net.Error that hit its timeout.
   933  type cancelTimerBody struct {
   934  	stop          func() // stops the time.Timer waiting to cancel the request
   935  	rc            io.ReadCloser
   936  	reqDidTimeout func() bool
   937  }
   938  
   939  func (b *cancelTimerBody) Read(p []byte) (n int, err error) {
   940  	n, err = b.rc.Read(p)
   941  	if err == nil {
   942  		return n, nil
   943  	}
   944  	b.stop()
   945  	if err == io.EOF {
   946  		return n, err
   947  	}
   948  	if b.reqDidTimeout() {
   949  		err = &httpError{
   950  			err:     err.Error() + " (Client.Timeout or context cancellation while reading body)",
   951  			timeout: true,
   952  		}
   953  	}
   954  	return n, err
   955  }
   956  
   957  func (b *cancelTimerBody) Close() error {
   958  	err := b.rc.Close()
   959  	b.stop()
   960  	return err
   961  }
   962  
   963  func shouldCopyHeaderOnRedirect(headerKey string, initial, dest *url.URL) bool {
   964  	switch CanonicalHeaderKey(headerKey) {
   965  	case "Authorization", "Www-Authenticate", "Cookie", "Cookie2":
   966  		// Permit sending auth/cookie headers from "foo.com"
   967  		// to "sub.foo.com".
   968  
   969  		// Note that we don't send all cookies to subdomains
   970  		// automatically. This function is only used for
   971  		// Cookies set explicitly on the initial outgoing
   972  		// client request. Cookies automatically added via the
   973  		// CookieJar mechanism continue to follow each
   974  		// cookie's scope as set by Set-Cookie. But for
   975  		// outgoing requests with the Cookie header set
   976  		// directly, we don't know their scope, so we assume
   977  		// it's for *.domain.com.
   978  
   979  		ihost := canonicalAddr(initial)
   980  		dhost := canonicalAddr(dest)
   981  		return isDomainOrSubdomain(dhost, ihost)
   982  	}
   983  	// All other headers are copied:
   984  	return true
   985  }
   986  
   987  // isDomainOrSubdomain reports whether sub is a subdomain (or exact
   988  // match) of the parent domain.
   989  //
   990  // Both domains must already be in canonical form.
   991  func isDomainOrSubdomain(sub, parent string) bool {
   992  	if sub == parent {
   993  		return true
   994  	}
   995  	// If sub is "foo.example.com" and parent is "example.com",
   996  	// that means sub must end in "."+parent.
   997  	// Do it without allocating.
   998  	if !strings.HasSuffix(sub, parent) {
   999  		return false
  1000  	}
  1001  	return sub[len(sub)-len(parent)-1] == '.'
  1002  }
  1003  
  1004  func stripPassword(u *url.URL) string {
  1005  	_, passSet := u.User.Password()
  1006  	if passSet {
  1007  		return strings.Replace(u.String(), u.User.String()+"@", u.User.Username()+":***@", 1)
  1008  	}
  1009  	return u.String()
  1010  }
  1011  

View as plain text