Set {@code -Dblazemeter.http.legacyRedirectMethodHandling=true} (or the legacy + * {@code HTTP2Sampler.*}/{@code httpJettyClient.*} equivalents) to opt back into JMeter 5.6.3's + * original behavior, bug included, for users who need byte-for-byte parity with stock JMeter. + */ +public final class Rfc9110Redirects { + + private static final String LEGACY_REDIRECT_METHOD_HANDLING_PROPERTY = + "blazemeter.http.legacyRedirectMethodHandling"; + + private Rfc9110Redirects() { + } + + public static boolean useLegacyMethodHandling() { + return BzmHttpPluginProperties.getPropDefault(LEGACY_REDIRECT_METHOD_HANDLING_PROPERTY, false); + } + + /** Matches {@code HTTPSampleResult.isRedirect()} post apache/jmeter PR #6658: unlike the + * unfixed JMeter 5.6.3 version, 307 is a redirect for any method, not just GET/HEAD. */ + public static boolean isRedirect(String responseCode) { + return HTTPConstants.SC_MOVED_PERMANENTLY.equals(responseCode) + || HTTPConstants.SC_MOVED_TEMPORARILY.equals(responseCode) + || HTTPConstants.SC_SEE_OTHER.equals(responseCode) + || HTTPConstants.SC_TEMPORARY_REDIRECT.equals(responseCode) + || HTTPConstants.SC_PERMANENT_REDIRECT.equals(responseCode); + } +} diff --git a/src/test/java/com/blazemeter/jmeter/http2/core/HTTP2JettyClientTest.java b/src/test/java/com/blazemeter/jmeter/http2/core/HTTP2JettyClientTest.java index 6b515b9..647d97c 100644 --- a/src/test/java/com/blazemeter/jmeter/http2/core/HTTP2JettyClientTest.java +++ b/src/test/java/com/blazemeter/jmeter/http2/core/HTTP2JettyClientTest.java @@ -19,6 +19,9 @@ import static com.blazemeter.jmeter.http2.core.ServerBuilder.SERVER_PATH_200_ZSTD; import static com.blazemeter.jmeter.http2.core.ServerBuilder.SERVER_PATH_200_WITH_BODY; import static com.blazemeter.jmeter.http2.core.ServerBuilder.SERVER_PATH_302; +import static com.blazemeter.jmeter.http2.core.ServerBuilder.SERVER_PATH_302_TO_ECHO; +import static com.blazemeter.jmeter.http2.core.ServerBuilder.SERVER_PATH_307_TO_ECHO; +import static com.blazemeter.jmeter.http2.core.ServerBuilder.SERVER_PATH_308_TO_ECHO; import static com.blazemeter.jmeter.http2.core.ServerBuilder.SERVER_PATH_400; import static com.blazemeter.jmeter.http2.core.ServerBuilder.SERVER_PATH_401_NO_WWW_AUTHENTICATE; import static com.blazemeter.jmeter.http2.core.ServerBuilder.SERVER_PATH_BIG_RESPONSE; @@ -226,6 +229,134 @@ public void shouldFollowRedirectWhenHeadMethodAndFollowRedirectEnabled() throws softly.assertThat(result.getResponseDataAsString()).isEmpty(); } + @Test + public void shouldNotResendRequestBodyWhenPostRedirectIsFollowedAsGet() throws Exception { + buildStartedServer(); + sampler.setMethod(HTTPConstants.POST); + sampler.setFollowRedirects(true); + sampler.addArgument("test1", TEST_ARGUMENT_1); + sampler.addArgument("test2", TEST_ARGUMENT_2); + + HTTPSampleResult result = sample(SERVER_PATH_302_TO_ECHO, HTTPConstants.POST); + + softly.assertThat(result.isSuccessful()).isTrue(); + softly.assertThat(result.getResponseCode()).isEqualTo("200"); + SampleResult[] subResults = result.getSubResults(); + softly.assertThat(subResults.length).isGreaterThan(0); + HTTPSampleResult followUp = (HTTPSampleResult) subResults[subResults.length - 1]; + softly.assertThat(followUp.getHTTPMethod()).isEqualTo(HTTPConstants.GET); + // SERVER_PATH_302_TO_ECHO redirects to SERVER_PATH_200_WITH_BODY, which echoes back + // any request body it receives. JMeter core rewrites POST to GET when following a + // 302, so the follow-up request must not carry the original POST entity (RFC 9110 + // section 15.4.3; matches HTTPSamplerProxy/HttpClient4 behavior). + softly.assertThat(followUp.getResponseDataAsString()).isEmpty(); + } + + @Test + public void shouldPreserveRequestBodyWhenPostRedirectIsFollowedAs307ViaAutoRedirects() + throws Exception { + // Unlike 301/302/303, RFC 9110 section 15.4.8 requires a 307 redirect to preserve the + // original method and body. With autoRedirects enabled, Jetty's own redirect support + // handles the follow-up (not JMeter's manual loop, see the *ViaFollowRedirectsOnly test + // below), and already implements this correctly - this test locks that in. + buildStartedServer(); + sampler.setMethod(HTTPConstants.POST); + sampler.setFollowRedirects(true); + sampler.setAutoRedirects(true); + sampler.addArgument("test1", TEST_ARGUMENT_1); + sampler.addArgument("test2", TEST_ARGUMENT_2); + + HTTPSampleResult result = sample(SERVER_PATH_307_TO_ECHO, HTTPConstants.POST); + + softly.assertThat(result.isSuccessful()).isTrue(); + softly.assertThat(result.getResponseCode()).isEqualTo("200"); + softly.assertThat(result.getResponseDataAsString()) + .isEqualTo("test1=" + TEST_ARGUMENT_1 + "&test2=" + TEST_ARGUMENT_2); + } + + @Test + public void shouldPreserveRequestBodyWhenPostRedirectIsFollowedAs307ViaFollowRedirectsOnly() + throws Exception { + // With autoRedirects OFF, JMeter's own manual follow-redirects loop drives this instead of + // Jetty. Apache JMeter got this wrong until apache/jmeter PR #6658 (merged 2026-03-19, not + // yet in the 5.6.3 release this project targets): HTTPSampleResult.isRedirect() only + // recognized 307 as a redirect for GET/HEAD (a POST+307 was returned as-is, never followed), + // and HTTPSamplerBase.computeMethodForRedirect() rewrote every redirected method to GET + // regardless of status code, dropping the body. HTTP2Sampler.resultProcessing() and + // .followRedirects() port JMeter's own logic with that upstream fix applied, so this path + // is correct even against JMeter 5.6.3's own (buggy) inherited implementation. + buildStartedServer(); + sampler.setMethod(HTTPConstants.POST); + sampler.setFollowRedirects(true); + sampler.setAutoRedirects(false); + sampler.addArgument("test1", TEST_ARGUMENT_1); + sampler.addArgument("test2", TEST_ARGUMENT_2); + + HTTPSampleResult result = sample(SERVER_PATH_307_TO_ECHO, HTTPConstants.POST); + + softly.assertThat(result.isSuccessful()).isTrue(); + softly.assertThat(result.getResponseCode()).isEqualTo("200"); + HTTPSampleResult followUp = + (HTTPSampleResult) result.getSubResults()[result.getSubResults().length - 1]; + softly.assertThat(followUp.getHTTPMethod()).isEqualTo(HTTPConstants.POST); + softly.assertThat(followUp.getResponseDataAsString()) + .isEqualTo("test1=" + TEST_ARGUMENT_1 + "&test2=" + TEST_ARGUMENT_2); + } + + @Test + public void shouldPreserveRequestBodyWhenPostRedirectIsFollowedAs308ViaFollowRedirectsOnly() + throws Exception { + // Same fix as the 307 case above (RFC 9110 section 15.4.9): unlike 307, JMeter 5.6.3's + // isRedirect() already recognized 308 for any method, but computeMethodForRedirect() still + // rewrote it to GET, dropping the body. + buildStartedServer(); + sampler.setMethod(HTTPConstants.POST); + sampler.setFollowRedirects(true); + sampler.setAutoRedirects(false); + sampler.addArgument("test1", TEST_ARGUMENT_1); + sampler.addArgument("test2", TEST_ARGUMENT_2); + + HTTPSampleResult result = sample(SERVER_PATH_308_TO_ECHO, HTTPConstants.POST); + + softly.assertThat(result.isSuccessful()).isTrue(); + softly.assertThat(result.getResponseCode()).isEqualTo("200"); + HTTPSampleResult followUp = + (HTTPSampleResult) result.getSubResults()[result.getSubResults().length - 1]; + softly.assertThat(followUp.getHTTPMethod()).isEqualTo(HTTPConstants.POST); + softly.assertThat(followUp.getResponseDataAsString()) + .isEqualTo("test1=" + TEST_ARGUMENT_1 + "&test2=" + TEST_ARGUMENT_2); + } + + @Test + public void shouldMatchJMeter563OriginalBehaviorWhenLegacyRedirectMethodHandlingEnabled() + throws Exception { + // Opt-out flag for users who need byte-for-byte parity with stock JMeter 5.6.3, bug + // included: a POST+307 is returned as-is (never followed), matching HTTPSampleResult + // .isRedirect()'s unfixed behavior for that status code. + String property = "blazemeter.http.legacyRedirectMethodHandling"; + String previous = JMeterUtils.getProperty(property); + JMeterUtils.setProperty(property, "true"); + try { + buildStartedServer(); + sampler.setMethod(HTTPConstants.POST); + sampler.setFollowRedirects(true); + sampler.setAutoRedirects(false); + sampler.addArgument("test1", TEST_ARGUMENT_1); + sampler.addArgument("test2", TEST_ARGUMENT_2); + + HTTPSampleResult result = sample(SERVER_PATH_307_TO_ECHO, HTTPConstants.POST); + + softly.assertThat(result.getResponseCode()).isEqualTo("307"); + softly.assertThat(result.getSubResults().length).isEqualTo(0); + } finally { + if (previous == null) { + JMeterUtils.getJMeterProperties().remove(property); + } else { + JMeterUtils.setProperty(property, previous); + } + } + } + private void buildStartedServer() throws Exception { server = new ServerBuilder() .withHTTP2() diff --git a/src/test/java/com/blazemeter/jmeter/http2/core/ServerBuilder.java b/src/test/java/com/blazemeter/jmeter/http2/core/ServerBuilder.java index 28cb501..8b9c0da 100644 --- a/src/test/java/com/blazemeter/jmeter/http2/core/ServerBuilder.java +++ b/src/test/java/com/blazemeter/jmeter/http2/core/ServerBuilder.java @@ -87,6 +87,13 @@ public class ServerBuilder { */ public static final String SERVER_PATH_401_NO_WWW_AUTHENTICATE = "/test/401-no-www-authenticate"; public static final String SERVER_PATH_302 = "/test/302"; + /** Redirects to {@link #SERVER_PATH_200_WITH_BODY}, which echoes back whatever body it received. */ + public static final String SERVER_PATH_302_TO_ECHO = "/test/302-to-echo"; + /** Same as {@link #SERVER_PATH_302_TO_ECHO} but with a 307, which RFC 9110 requires to + * preserve the original method and body (unlike 301/302/303). */ + public static final String SERVER_PATH_307_TO_ECHO = "/test/307-to-echo"; + /** Same as {@link #SERVER_PATH_307_TO_ECHO} but with a 308 (also method/body-preserving). */ + public static final String SERVER_PATH_308_TO_ECHO = "/test/308-to-echo"; public static final String SERVER_PATH_200_WITH_BODY = "/test/body"; public static final String SERVER_PATH_JSON_ONLY = "/test/json-only"; public static final String SERVER_PATH_DELETE_DATA = "/test/delete"; @@ -325,6 +332,21 @@ protected void service(HttpServletRequest req, HttpServletResponse resp) "https://localhost:" + req.getLocalPort() + SERVER_PATH_200); resp.setStatus(HttpStatus.FOUND_302); break; + case SERVER_PATH_302_TO_ECHO: + resp.addHeader(HTTPConstants.HEADER_LOCATION, + "https://localhost:" + req.getLocalPort() + SERVER_PATH_200_WITH_BODY); + resp.setStatus(HttpStatus.FOUND_302); + break; + case SERVER_PATH_307_TO_ECHO: + resp.addHeader(HTTPConstants.HEADER_LOCATION, + "https://localhost:" + req.getLocalPort() + SERVER_PATH_200_WITH_BODY); + resp.setStatus(HttpStatus.TEMPORARY_REDIRECT_307); + break; + case SERVER_PATH_308_TO_ECHO: + resp.addHeader(HTTPConstants.HEADER_LOCATION, + "https://localhost:" + req.getLocalPort() + SERVER_PATH_200_WITH_BODY); + resp.setStatus(HttpStatus.PERMANENT_REDIRECT_308); + break; case SERVER_PATH_200_WITH_BODY: String bodyRequest = req.getReader().lines().collect(Collectors.joining()); resp.getWriter().write(bodyRequest);