From: Pierce Lopez <pierce.lopez@gmail.com>
Date: Tue, 22 Sep 2020 18:00:21 +0000 (-0400)
Subject: simple_httpclient: after 303 redirect, turn all methods into GET
X-Git-Tag: v6.1.0b1~7^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F2918%2Fhead;p=thirdparty%2Ftornado.git

simple_httpclient: after 303 redirect, turn all methods into GET

not just POST (but still not HEAD)

following the behavior of libcurl > 7.70
---

diff --git a/tornado/simple_httpclient.py b/tornado/simple_httpclient.py
index 67bbe2a02..c977aeefd 100644
--- a/tornado/simple_httpclient.py
+++ b/tornado/simple_httpclient.py
@@ -634,11 +634,12 @@ class _HTTPConnection(httputil.HTTPMessageDelegate):
             # redirect, the request method should be preserved.
             # However, browsers implemented this by changing the
             # method to GET, and the behavior stuck. 303 redirects
-            # always specified this POST-to-GET behavior (arguably 303
-            # redirects should change *all* requests to GET, but
-            # libcurl only does this for POST so we follow their
-            # example).
-            if self.code in (301, 302, 303) and self.request.method == "POST":
+            # always specified this POST-to-GET behavior, arguably
+            # for *all* methods, but libcurl < 7.70 only does this
+            # for POST, while libcurl >= 7.70 does it for other methods.
+            if (self.code == 303 and self.request.method != "HEAD") or (
+                self.code in (301, 302) and self.request.method == "POST"
+            ):
                 new_request.method = "GET"
                 new_request.body = None
                 for h in [