Analysis of alleged HEAD bug

[Ortwin Glück <or...@nose.ch>]

I analyzed the network traffic between tamino.demozone.softwareag.com 
and httpclient and saw the following:

----
HEAD /taminowebdavserver/yourstore/PictureDemo HTTP/1.1
Host: tamino.demozone.softwareag.com
User-Agent: Jakarta Commons-HttpClient/2.0M1

HTTP/1.1 401
Date: Wed, 18 Dec 2002 19:34:15 GMT
Server: Apache/1.3.27 (Win32) mod_jk/1.2.0
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
WWW-Authenticate: Basic realm="Tamino WebDAV Server"
Content-Type: text/html

<html><head><title>Apache Tomcat/4.1.9 - Error 
report</title><STYLE><!--H1{font-family : sans-serif,Arial,Tahoma;color 
: white;background-color : #0086b2;} H3{font-family : 
sans-serif,Arial,Tahoma;color : white;background-color : #0086b2;} 
BODY{font-family : sans-serif,Arial,Tahoma;color : 
black;background-color : white;} B{color : white;background-color : 
#0086b2;} HR{color : #0086b2;} --></STYLE> </head><body><h1>HTTP Status 
401 - </h1><HR size="1" noshade><p><b>type</b> Status 
report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>This 
request requires HTTP authentication ().</u></p><HR size="1" 
noshade><h3>Apache Tomcat/4.1.9</h3></body></html>
-------

Note that the missing Content-Length / Transfer-Encoding header is 
clearly a violation of RFC 2616, section 4.3:

"The rules for when a message-body is allowed in a message differ for
    requests and responses.

    The presence of a message-body in a request is signaled by the
    inclusion of a Content-Length or Transfer-Encoding header field in
    the request's message-headers. A message-body MUST NOT be included in
    a request if the specification of the request method (section 5.1.1)
    does not allow sending an entity-body in requests."

Details for the 401 status response are described in section 10.4.2 but 
contain no further relevant information.

The server does not close the connection after the body. So this is not 
a valid HTTP/1.0 (despite the 1.1 response tag) behaviour either.

This is a bug in Apache's HTTPD and should be reported back to our 
colleagues from the HTTPD project.

Running the same code against a modified BasicAuthServlet from the 
HttpClient Webapp Test running on Tomcat standalone, I see that Tomcat 
includes both Connection and Transfer-Encoding headers correctly as 
expected. So we are unable to reproduce this behaviour using Tomcat for 
our webapp tests.

[DEBUG] wire - ->> [\r\n]
[DEBUG] wire - -<< "HTTP/1.1 401 Unauthorized" [\r\n]
[DEBUG] wire - -<< "Content-Type: text/html" [\r\n]
[DEBUG] wire - -<< "Connection: close" [\r\n]
[DEBUG] wire - -<< "Date: Wed, 18 Dec 2002 19:48:47 GMT" [\r\n]
[DEBUG] wire - -<< "www-authenticate: Basic realm="BasicAuthServlet""[\r\n]
[DEBUG] wire - -<< "Transfer-Encoding: chunked" [\r\n]
[DEBUG] wire - -<< "Server: Apache Tomcat/4.0.1 (HTTP/1.1 Connector)" [\r\n]


I am sorry but we can only report this to HTTPD Team and wait.

I hereby request that no patch be committed to CVS on this issue.

Odi

Re: Analysis of alleged HEAD bug

[Ortwin Glück <or...@nose.ch>]

Added a webapp test case for this issue which succeeds with the current 
code if webapp runs on Tomcat standalone.

Odi