Re: RFR: 8211420: com.sun.net.httpserver.HttpServer returns Content-length header for 204 response code

2018-10-05 Thread Chris Hegarty 

On 04/10/18 17:09, Michael McMahon wrote:

Could I get the following fix reviewed please?

http://cr.openjdk.java.net/~michaelm/8211420/webrev.1/index.html


Looks good. Trivially, can you update the copyright year
in the test before pushing.

-Chris

Re: HttpClient Headers

2018-10-05 Thread Michael McMahon 

Hi Thomas,

Yes, I just looked at RFC7231 (section 5.5.2) and while there are 
security implications
of usage of the 'Referer' header, the HTTP client library does not have 
the relevant context
to decide whether it should be set or not. My view is that this is the 
responsibility of
the calling code. We will probably do a review of all of these 
restricted headers and

then propose a change to this area.

Thanks,

Michael.

On 04/10/2018, 18:41, Thomas Lußnig wrote:

Hi,

i have an question about the new HttpClient from JDK11.

Is there any good reason that the Referer header is restricted?
Because i have scenarios where the customer server expect Referer 
header in the Login sequence.

So is there any way how to set restricted headers?


Gruß Thomas

On 14.08.2018 15:59:51, Michael McMahon wrote:

Hi,

This is an important fix for 11 which addresses the problem where 
HTTP/1.0
responses that do not include a content-length header are not handled 
correctly.


http://cr.openjdk.java.net/~michaelm/8207966/webrev.2/index.html

Thanks,
Michael.