diff options
| author | Ed Tanous <edtanous@google.com> | 2022-09-22 01:28:04 +0300 |
|---|---|---|
| committer | Gunnar Mills <gmills@us.ibm.com> | 2022-09-22 23:37:39 +0300 |
| commit | 4a0e1a0cf378e7bf4909c2ea8fc6e77e0d77ca6d (patch) | |
| tree | 30e03e09b078d0bb2d1f6812852beb75f0569939 /include/forward_unauthorized.hpp | |
| parent | 656472d942f46194bcd6f59c6eca4658fee20c71 (diff) | |
| download | bmcweb-4a0e1a0cf378e7bf4909c2ea8fc6e77e0d77ca6d.tar.xz | |
Fix content-type return behavior for */*
An HTTP header of Accepts: */* throws a big wrench into our
implementation for a couple reasons. First, because it's the default in
a lot of commonly-used libraries, and second, because clients use it
when they certainly don't mean what the specification says it should
mean "ie, I accept ANY type".
This commit tries to address some of that, by making an explicit option
for content-type="ANY" and pushes it to the individual callers to handle
explicitly as if it were yet another type. In most protocols, there's a
"most common" representation, so protocols are free to use that, or to
explicitly handle it, and require that the user be explicit.
Tested:
Redfish Protocol Validator no longer locks up. (TBD, getting bugs filed
with protocol validator for this missing Accepts header).
For ServiceRoot
GET /redfish/v1 Accepts: application/json - returns json
GET /redfish/v1 Accepts: */* - returns json
GET /redfish/v1 Accepts: text/html - returns html
GET /redfish/v1 no-accepts header - returns json
Redfish-service-validator passes.
Signed-off-by: Ed Tanous <edtanous@google.com>
Change-Id: Iae6711ae587115d3e159a48a6fc46a903ed6c403
Diffstat (limited to 'include/forward_unauthorized.hpp')
| -rw-r--r-- | include/forward_unauthorized.hpp | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/include/forward_unauthorized.hpp b/include/forward_unauthorized.hpp index 75f2dae20f..2fc3ee45f5 100644 --- a/include/forward_unauthorized.hpp +++ b/include/forward_unauthorized.hpp @@ -14,8 +14,8 @@ inline void sendUnauthorized(std::string_view url, { // If it's a browser connecting, don't send the HTTP authenticate // header, to avoid possible CSRF attacks with basic auth - if (http_helpers::isContentTypeAllowed(accept, - http_helpers::ContentType::HTML)) + if (http_helpers::isContentTypeAllowed( + accept, http_helpers::ContentType::HTML, false /*allowWildcard*/)) { // If we have a webui installed, redirect to that login page if (hasWebuiRoute) |