httpcaddyfile: redir with "html" emits 200, no Location (fix #4940)

The intent of "html" is to redirect browser clients only, or those which can evaluate JS and/or meta tags. So return HTTP 200 and no Location header. See #4940.

Matthew Holt committed Aug 9, 2022 at 11:11 UTC 91ab0e60669b84b7c09189a06de0d6a9771bf950

1 file changed +14 -3

caddyconfig/httpcaddyfile/builtins.go

+14 -3

@@ -540,8 +540,13 @@ func parseVars(h Helper) (caddyhttp.MiddlewareHandler, error) {

540

541 // parseRedir parses the redir directive. Syntax:

542 //

543 -// redir [<matcher>] <to> [<code>]

543 +// redir [<matcher>] <to> [<code>]

544 //

545 +// <code> can be "permanent" for 301, "temporary" for 302 (default),

546 +// a placeholder, or any number in the 3xx range or 401. The special

547 +// code "html" can be used to redirect only browser clients (will

548 +// respond with HTTP 200 and no Location header; redirect is performed

549 +// with JS and a meta tag).

550 func parseRedir(h Helper) (caddyhttp.MiddlewareHandler, error) {

551 if !h.Next() {

552 return nil, h.ArgErr()

@@ -558,6 +563,7 @@ func parseRedir(h Helper) (caddyhttp.MiddlewareHandler, error) {

563 }

564

565 var body string

566 + var hdr http.Header

567 switch code {

568 case "permanent":

569 code = "301"

@@ -578,7 +584,7 @@ func parseRedir(h Helper) (caddyhttp.MiddlewareHandler, error) {

584 `

585 safeTo := html.EscapeString(to)

586 body = fmt.Sprintf(metaRedir, safeTo, safeTo, safeTo, safeTo)

581 - code = "302"

587 + code = "200" // don't redirect non-browser clients

588 default:

589 // Allow placeholders for the code

590 if strings.HasPrefix(code, "{") {

@@ -601,9 +607,14 @@ func parseRedir(h Helper) (caddyhttp.MiddlewareHandler, error) {

607 }

608 }

609

610 + // don't redirect non-browser clients

611 + if code != "200" {

612 + hdr = http.Header{"Location": []string{to}}

613 + }

614 +

615 return caddyhttp.StaticResponse{

616 StatusCode: caddyhttp.WeakString(code),

606 - Headers: http.Header{"Location": []string{to}},

617 + Headers: hdr,

618 Body: body,

619 }, nil

620 }