Page MenuHomePhabricator

Add support for HTTP 307 and 308 to OutputPage::redirect
Open, Stalled, NormalPublic

Description

The authentication system for the Hydra Wiki Platform uses 307 and 308 redirects in a few places. Instead of implementing our own redirect code we added this to the base MediaWiki code.

https://gerrit.wikimedia.org/r/425439

Event Timeline

Alexia created this task.Apr 10 2018, 10:31 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 10 2018, 10:31 PM

Change 425439 had a related patch set uploaded (by Krinkle; owner: Alexia):
[mediawiki/core@master] Add support for HTTP 307 and 308 to OutputPage::redirect()

https://gerrit.wikimedia.org/r/425439

Krinkle renamed this task from Add support for 307 and 308 redirects. to Add support for HTTP 307 and 308 to OutputPage::redirect.Apr 12 2018, 12:32 AM

@Alexia Reminder about the CR at https://gerrit.wikimedia.org/r/#/c/mediawiki/core/+/425439/3/includes/OutputPage.php

In summary: The existing code seems to unintentionally not apply to 302 (Temporary) and only to 301 and 303. As such, adding 308 (Permanent) seems fine, but 307 (also Temporary) might be problematic, specially for the Last-Modified behaviour which seems is intentionally not applied to temporary redirects.

I would recommend switching the logic around so that the status header is always applied (including for the new 307 and 308 statuses), but keep the lastModified logic only applied to permanent redirects.

Krinkle changed the task status from Open to Stalled.Jun 15 2018, 10:02 PM
Krinkle triaged this task as Normal priority.