Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

[BC Break] Form POSTs w/o Accept return application/x-www-form-urlencoded response Content-Type #34906

Copy link
Copy link
Closed
@weaverryan

Description

@weaverryan
Issue body actions

Symfony version(s) affected: 4.4.0

Description
Hi! Due to #32344, if you POST a form submit but do not send any Accept headers, the response Content-Type will be the invalid application/x-www-form-urlencoded.

This doesn't happen in practice in a browser (which sends an Accept header), but DOES happen in functional tests - and is very difficult to debug.

The problem is that, in $response->prepare(), $request->getPreferredFormat() is called to try to figure out the correct Content-Type. If there is no Accept header, it eventually falls back to to using the request Content-Type as the default value:

$this->preferredFormat = $this->getRequestFormat($preferredFormat ?: $this->getContentType());

But in 4.3, it used "html".

How to reproduce
Set up or find any deployed 4.4 form submit. Submit in your browser, then use the "Copy as Curl" tool in your browser network tools. Paste that into your terminal, but remove the -H Accept header.

That's it! Check out the Content-Type header on the response.

Possible Solution
The last 2 lines of Request::getPreferredFormat() should maybe be:

- $this->preferredFormat = $this->getRequestFormat($preferredFormat ?: $this->getContentType());
+ $this->preferredFormat = $this->getRequestFormat($preferredFormat ?: $default);

Ping @yceruto :)

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      Morty Proxy This is a proxified and sanitized view of the page, visit original site.