1 // Copyright 2009 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 // HTTP Request reading and parsing. 6 7 package http 8 9 import ( 10 "bufio" 11 "bytes" 12 "context" 13 "crypto/tls" 14 "encoding/base64" 15 "errors" 16 "fmt" 17 "io" 18 "io/ioutil" 19 "mime" 20 "mime/multipart" 21 "net" 22 "net/http/httptrace" 23 "net/textproto" 24 "net/url" 25 "strconv" 26 "strings" 27 "sync" 28 29 "golang.org/x/net/idna" 30 ) 31 32 const ( 33 defaultMaxMemory = 32 << 20 // 32 MB 34 ) 35 36 // ErrMissingFile is returned by FormFile when the provided file field name 37 // is either not present in the request or not a file field. 38 var ErrMissingFile = errors.New("http: no such file") 39 40 // ProtocolError represents an HTTP protocol error. 41 // 42 // Deprecated: Not all errors in the http package related to protocol errors 43 // are of type ProtocolError. 44 type ProtocolError struct { 45 ErrorString string 46 } 47 48 func (pe *ProtocolError) Error() string { return pe.ErrorString } 49 50 var ( 51 // ErrNotSupported is returned by the Push method of Pusher 52 // implementations to indicate that HTTP/2 Push support is not 53 // available. 54 ErrNotSupported = &ProtocolError{"feature not supported"} 55 56 // Deprecated: ErrUnexpectedTrailer is no longer returned by 57 // anything in the net/http package. Callers should not 58 // compare errors against this variable. 59 ErrUnexpectedTrailer = &ProtocolError{"trailer header without chunked transfer encoding"} 60 61 // ErrMissingBoundary is returned by Request.MultipartReader when the 62 // request's Content-Type does not include a "boundary" parameter. 63 ErrMissingBoundary = &ProtocolError{"no multipart boundary param in Content-Type"} 64 65 // ErrNotMultipart is returned by Request.MultipartReader when the 66 // request's Content-Type is not multipart/form-data. 67 ErrNotMultipart = &ProtocolError{"request Content-Type isn't multipart/form-data"} 68 69 // Deprecated: ErrHeaderTooLong is no longer returned by 70 // anything in the net/http package. Callers should not 71 // compare errors against this variable. 72 ErrHeaderTooLong = &ProtocolError{"header too long"} 73 74 // Deprecated: ErrShortBody is no longer returned by 75 // anything in the net/http package. Callers should not 76 // compare errors against this variable. 77 ErrShortBody = &ProtocolError{"entity body too short"} 78 79 // Deprecated: ErrMissingContentLength is no longer returned by 80 // anything in the net/http package. Callers should not 81 // compare errors against this variable. 82 ErrMissingContentLength = &ProtocolError{"missing ContentLength in HEAD response"} 83 ) 84 85 type badStringError struct { 86 what string 87 str string 88 } 89 90 func (e *badStringError) Error() string { return fmt.Sprintf("%s %q", e.what, e.str) } 91 92 // Headers that Request.Write handles itself and should be skipped. 93 var reqWriteExcludeHeader = map[string]bool{ 94 "Host": true, // not in Header map anyway 95 "User-Agent": true, 96 "Content-Length": true, 97 "Transfer-Encoding": true, 98 "Trailer": true, 99 } 100 101 // A Request represents an HTTP request received by a server 102 // or to be sent by a client. 103 // 104 // The field semantics differ slightly between client and server 105 // usage. In addition to the notes on the fields below, see the 106 // documentation for Request.Write and RoundTripper. 107 type Request struct { 108 // Method specifies the HTTP method (GET, POST, PUT, etc.). 109 // For client requests, an empty string means GET. 110 // 111 // Go's HTTP client does not support sending a request with 112 // the CONNECT method. See the documentation on Transport for 113 // details. 114 Method string 115 116 // URL specifies either the URI being requested (for server 117 // requests) or the URL to access (for client requests). 118 // 119 // For server requests, the URL is parsed from the URI 120 // supplied on the Request-Line as stored in RequestURI. For 121 // most requests, fields other than Path and RawQuery will be 122 // empty. (See RFC 7230, Section 5.3) 123 // 124 // For client requests, the URL's Host specifies the server to 125 // connect to, while the Request's Host field optionally 126 // specifies the Host header value to send in the HTTP 127 // request. 128 URL *url.URL 129 130 // The protocol version for incoming server requests. 131 // 132 // For client requests, these fields are ignored. The HTTP 133 // client code always uses either HTTP/1.1 or HTTP/2. 134 // See the docs on Transport for details. 135 Proto string // "HTTP/1.0" 136 ProtoMajor int // 1 137 ProtoMinor int // 0 138 139 // Header contains the request header fields either received 140 // by the server or to be sent by the client. 141 // 142 // If a server received a request with header lines, 143 // 144 // Host: example.com 145 // accept-encoding: gzip, deflate 146 // Accept-Language: en-us 147 // fOO: Bar 148 // foo: two 149 // 150 // then 151 // 152 // Header = map[string][]string{ 153 // "Accept-Encoding": {"gzip, deflate"}, 154 // "Accept-Language": {"en-us"}, 155 // "Foo": {"Bar", "two"}, 156 // } 157 // 158 // For incoming requests, the Host header is promoted to the 159 // Request.Host field and removed from the Header map. 160 // 161 // HTTP defines that header names are case-insensitive. The 162 // request parser implements this by using CanonicalHeaderKey, 163 // making the first character and any characters following a 164 // hyphen uppercase and the rest lowercase. 165 // 166 // For client requests, certain headers such as Content-Length 167 // and Connection are automatically written when needed and 168 // values in Header may be ignored. See the documentation 169 // for the Request.Write method. 170 Header Header 171 172 // Body is the request's body. 173 // 174 // For client requests, a nil body means the request has no 175 // body, such as a GET request. The HTTP Client's Transport 176 // is responsible for calling the Close method. 177 // 178 // For server requests, the Request Body is always non-nil 179 // but will return EOF immediately when no body is present. 180 // The Server will close the request body. The ServeHTTP 181 // Handler does not need to. 182 Body io.ReadCloser 183 184 // GetBody defines an optional func to return a new copy of 185 // Body. It is used for client requests when a redirect requires 186 // reading the body more than once. Use of GetBody still 187 // requires setting Body. 188 // 189 // For server requests, it is unused. 190 GetBody func() (io.ReadCloser, error) 191 192 // ContentLength records the length of the associated content. 193 // The value -1 indicates that the length is unknown. 194 // Values >= 0 indicate that the given number of bytes may 195 // be read from Body. 196 // 197 // For client requests, a value of 0 with a non-nil Body is 198 // also treated as unknown. 199 ContentLength int64 200 201 // TransferEncoding lists the transfer encodings from outermost to 202 // innermost. An empty list denotes the "identity" encoding. 203 // TransferEncoding can usually be ignored; chunked encoding is 204 // automatically added and removed as necessary when sending and 205 // receiving requests. 206 TransferEncoding []string 207 208 // Close indicates whether to close the connection after 209 // replying to this request (for servers) or after sending this 210 // request and reading its response (for clients). 211 // 212 // For server requests, the HTTP server handles this automatically 213 // and this field is not needed by Handlers. 214 // 215 // For client requests, setting this field prevents re-use of 216 // TCP connections between requests to the same hosts, as if 217 // Transport.DisableKeepAlives were set. 218 Close bool 219 220 // For server requests, Host specifies the host on which the URL 221 // is sought. Per RFC 7230, section 5.4, this is either the value 222 // of the "Host" header or the host name given in the URL itself. 223 // It may be of the form "host:port". For international domain 224 // names, Host may be in Punycode or Unicode form. Use 225 // golang.org/x/net/idna to convert it to either format if 226 // needed. 227 // To prevent DNS rebinding attacks, server Handlers should 228 // validate that the Host header has a value for which the 229 // Handler considers itself authoritative. The included 230 // ServeMux supports patterns registered to particular host 231 // names and thus protects its registered Handlers. 232 // 233 // For client requests, Host optionally overrides the Host 234 // header to send. If empty, the Request.Write method uses 235 // the value of URL.Host. Host may contain an international 236 // domain name. 237 Host string 238 239 // Form contains the parsed form data, including both the URL 240 // field's query parameters and the PATCH, POST, or PUT form data. 241 // This field is only available after ParseForm is called. 242 // The HTTP client ignores Form and uses Body instead. 243 Form url.Values 244 245 // PostForm contains the parsed form data from PATCH, POST 246 // or PUT body parameters. 247 // 248 // This field is only available after ParseForm is called. 249 // The HTTP client ignores PostForm and uses Body instead. 250 PostForm url.Values 251 252 // MultipartForm is the parsed multipart form, including file uploads. 253 // This field is only available after ParseMultipartForm is called. 254 // The HTTP client ignores MultipartForm and uses Body instead. 255 MultipartForm *multipart.Form 256 257 // Trailer specifies additional headers that are sent after the request 258 // body. 259 // 260 // For server requests, the Trailer map initially contains only the 261 // trailer keys, with nil values. (The client declares which trailers it 262 // will later send.) While the handler is reading from Body, it must 263 // not reference Trailer. After reading from Body returns EOF, Trailer 264 // can be read again and will contain non-nil values, if they were sent 265 // by the client. 266 // 267 // For client requests, Trailer must be initialized to a map containing 268 // the trailer keys to later send. The values may be nil or their final 269 // values. The ContentLength must be 0 or -1, to send a chunked request. 270 // After the HTTP request is sent the map values can be updated while 271 // the request body is read. Once the body returns EOF, the caller must 272 // not mutate Trailer. 273 // 274 // Few HTTP clients, servers, or proxies support HTTP trailers. 275 Trailer Header 276 277 // RemoteAddr allows HTTP servers and other software to record 278 // the network address that sent the request, usually for 279 // logging. This field is not filled in by ReadRequest and 280 // has no defined format. The HTTP server in this package 281 // sets RemoteAddr to an "IP:port" address before invoking a 282 // handler. 283 // This field is ignored by the HTTP client. 284 RemoteAddr string 285 286 // RequestURI is the unmodified request-target of the 287 // Request-Line (RFC 7230, Section 3.1.1) as sent by the client 288 // to a server. Usually the URL field should be used instead. 289 // It is an error to set this field in an HTTP client request. 290 RequestURI string 291 292 // TLS allows HTTP servers and other software to record 293 // information about the TLS connection on which the request 294 // was received. This field is not filled in by ReadRequest. 295 // The HTTP server in this package sets the field for 296 // TLS-enabled connections before invoking a handler; 297 // otherwise it leaves the field nil. 298 // This field is ignored by the HTTP client. 299 TLS *tls.ConnectionState 300 301 // Cancel is an optional channel whose closure indicates that the client 302 // request should be regarded as canceled. Not all implementations of 303 // RoundTripper may support Cancel. 304 // 305 // For server requests, this field is not applicable. 306 // 307 // Deprecated: Set the Request's context with NewRequestWithContext 308 // instead. If a Request's Cancel field and context are both 309 // set, it is undefined whether Cancel is respected. 310 Cancel <-chan struct{} 311 312 // Response is the redirect response which caused this request 313 // to be created. This field is only populated during client 314 // redirects. 315 Response *Response 316 317 // ctx is either the client or server context. It should only 318 // be modified via copying the whole Request using WithContext. 319 // It is unexported to prevent people from using Context wrong 320 // and mutating the contexts held by callers of the same request. 321 ctx context.Context 322 } 323 324 // Context returns the request's context. To change the context, use 325 // WithContext. 326 // 327 // The returned context is always non-nil; it defaults to the 328 // background context. 329 // 330 // For outgoing client requests, the context controls cancellation. 331 // 332 // For incoming server requests, the context is canceled when the 333 // client's connection closes, the request is canceled (with HTTP/2), 334 // or when the ServeHTTP method returns. 335 func (r *Request) Context() context.Context { 336 if r.ctx != nil { 337 return r.ctx 338 } 339 return context.Background() 340 } 341 342 // WithContext returns a shallow copy of r with its context changed 343 // to ctx. The provided ctx must be non-nil. 344 // 345 // For outgoing client request, the context controls the entire 346 // lifetime of a request and its response: obtaining a connection, 347 // sending the request, and reading the response headers and body. 348 // 349 // To create a new request with a context, use NewRequestWithContext. 350 // To change the context of a request (such as an incoming) you then 351 // also want to modify to send back out, use Request.Clone. Between 352 // those two uses, it's rare to need WithContext. 353 func (r *Request) WithContext(ctx context.Context) *Request { 354 if ctx == nil { 355 panic("nil context") 356 } 357 r2 := new(Request) 358 *r2 = *r 359 r2.ctx = ctx 360 r2.URL = cloneURL(r.URL) // legacy behavior; TODO: try to remove. Issue 23544 361 return r2 362 } 363 364 // Clone returns a deep copy of r with its context changed to ctx. 365 // The provided ctx must be non-nil. 366 // 367 // For an outgoing client request, the context controls the entire 368 // lifetime of a request and its response: obtaining a connection, 369 // sending the request, and reading the response headers and body. 370 func (r *Request) Clone(ctx context.Context) *Request { 371 if ctx == nil { 372 panic("nil context") 373 } 374 r2 := new(Request) 375 *r2 = *r 376 r2.ctx = ctx 377 r2.URL = cloneURL(r.URL) 378 if r.Header != nil { 379 r2.Header = r.Header.Clone() 380 } 381 if r.Trailer != nil { 382 r2.Trailer = r.Trailer.Clone() 383 } 384 if s := r.TransferEncoding; s != nil { 385 s2 := make([]string, len(s)) 386 copy(s2, s) 387 r2.TransferEncoding = s 388 } 389 r2.Form = cloneURLValues(r.Form) 390 r2.PostForm = cloneURLValues(r.PostForm) 391 r2.MultipartForm = cloneMultipartForm(r.MultipartForm) 392 return r2 393 } 394 395 // ProtoAtLeast reports whether the HTTP protocol used 396 // in the request is at least major.minor. 397 func (r *Request) ProtoAtLeast(major, minor int) bool { 398 return r.ProtoMajor > major || 399 r.ProtoMajor == major && r.ProtoMinor >= minor 400 } 401 402 // UserAgent returns the client's User-Agent, if sent in the request. 403 func (r *Request) UserAgent() string { 404 return r.Header.Get("User-Agent") 405 } 406 407 // Cookies parses and returns the HTTP cookies sent with the request. 408 func (r *Request) Cookies() []*Cookie { 409 return readCookies(r.Header, "") 410 } 411 412 // ErrNoCookie is returned by Request's Cookie method when a cookie is not found. 413 var ErrNoCookie = errors.New("http: named cookie not present") 414 415 // Cookie returns the named cookie provided in the request or 416 // ErrNoCookie if not found. 417 // If multiple cookies match the given name, only one cookie will 418 // be returned. 419 func (r *Request) Cookie(name string) (*Cookie, error) { 420 for _, c := range readCookies(r.Header, name) { 421 return c, nil 422 } 423 return nil, ErrNoCookie 424 } 425 426 // AddCookie adds a cookie to the request. Per RFC 6265 section 5.4, 427 // AddCookie does not attach more than one Cookie header field. That 428 // means all cookies, if any, are written into the same line, 429 // separated by semicolon. 430 func (r *Request) AddCookie(c *Cookie) { 431 s := fmt.Sprintf("%s=%s", sanitizeCookieName(c.Name), sanitizeCookieValue(c.Value)) 432 if c := r.Header.Get("Cookie"); c != "" { 433 r.Header.Set("Cookie", c+"; "+s) 434 } else { 435 r.Header.Set("Cookie", s) 436 } 437 } 438 439 // Referer returns the referring URL, if sent in the request. 440 // 441 // Referer is misspelled as in the request itself, a mistake from the 442 // earliest days of HTTP. This value can also be fetched from the 443 // Header map as Header["Referer"]; the benefit of making it available 444 // as a method is that the compiler can diagnose programs that use the 445 // alternate (correct English) spelling req.Referrer() but cannot 446 // diagnose programs that use Header["Referrer"]. 447 func (r *Request) Referer() string { 448 return r.Header.Get("Referer") 449 } 450 451 // multipartByReader is a sentinel value. 452 // Its presence in Request.MultipartForm indicates that parsing of the request 453 // body has been handed off to a MultipartReader instead of ParseMultipartForm. 454 var multipartByReader = &multipart.Form{ 455 Value: make(map[string][]string), 456 File: make(map[string][]*multipart.FileHeader), 457 } 458 459 // MultipartReader returns a MIME multipart reader if this is a 460 // multipart/form-data or a multipart/mixed POST request, else returns nil and an error. 461 // Use this function instead of ParseMultipartForm to 462 // process the request body as a stream. 463 func (r *Request) MultipartReader() (*multipart.Reader, error) { 464 if r.MultipartForm == multipartByReader { 465 return nil, errors.New("http: MultipartReader called twice") 466 } 467 if r.MultipartForm != nil { 468 return nil, errors.New("http: multipart handled by ParseMultipartForm") 469 } 470 r.MultipartForm = multipartByReader 471 return r.multipartReader(true) 472 } 473 474 func (r *Request) multipartReader(allowMixed bool) (*multipart.Reader, error) { 475 v := r.Header.Get("Content-Type") 476 if v == "" { 477 return nil, ErrNotMultipart 478 } 479 d, params, err := mime.ParseMediaType(v) 480 if err != nil || !(d == "multipart/form-data" || allowMixed && d == "multipart/mixed") { 481 return nil, ErrNotMultipart 482 } 483 boundary, ok := params["boundary"] 484 if !ok { 485 return nil, ErrMissingBoundary 486 } 487 return multipart.NewReader(r.Body, boundary), nil 488 } 489 490 // isH2Upgrade reports whether r represents the http2 "client preface" 491 // magic string. 492 func (r *Request) isH2Upgrade() bool { 493 return r.Method == "PRI" && len(r.Header) == 0 && r.URL.Path == "*" && r.Proto == "HTTP/2.0" 494 } 495 496 // Return value if nonempty, def otherwise. 497 func valueOrDefault(value, def string) string { 498 if value != "" { 499 return value 500 } 501 return def 502 } 503 504 // NOTE: This is not intended to reflect the actual Go version being used. 505 // It was changed at the time of Go 1.1 release because the former User-Agent 506 // had ended up on a blacklist for some intrusion detection systems. 507 // See https://codereview.appspot.com/7532043. 508 const defaultUserAgent = "Go-http-client/1.1" 509 510 // Write writes an HTTP/1.1 request, which is the header and body, in wire format. 511 // This method consults the following fields of the request: 512 // Host 513 // URL 514 // Method (defaults to "GET") 515 // Header 516 // ContentLength 517 // TransferEncoding 518 // Body 519 // 520 // If Body is present, Content-Length is <= 0 and TransferEncoding 521 // hasn't been set to "identity", Write adds "Transfer-Encoding: 522 // chunked" to the header. Body is closed after it is sent. 523 func (r *Request) Write(w io.Writer) error { 524 return r.write(w, false, nil, nil) 525 } 526 527 // WriteProxy is like Write but writes the request in the form 528 // expected by an HTTP proxy. In particular, WriteProxy writes the 529 // initial Request-URI line of the request with an absolute URI, per 530 // section 5.3 of RFC 7230, including the scheme and host. 531 // In either case, WriteProxy also writes a Host header, using 532 // either r.Host or r.URL.Host. 533 func (r *Request) WriteProxy(w io.Writer) error { 534 return r.write(w, true, nil, nil) 535 } 536 537 // errMissingHost is returned by Write when there is no Host or URL present in 538 // the Request. 539 var errMissingHost = errors.New("http: Request.Write on Request with no Host or URL set") 540 541 // extraHeaders may be nil 542 // waitForContinue may be nil 543 func (r *Request) write(w io.Writer, usingProxy bool, extraHeaders Header, waitForContinue func() bool) (err error) { 544 trace := httptrace.ContextClientTrace(r.Context()) 545 if trace != nil && trace.WroteRequest != nil { 546 defer func() { 547 trace.WroteRequest(httptrace.WroteRequestInfo{ 548 Err: err, 549 }) 550 }() 551 } 552 553 // Find the target host. Prefer the Host: header, but if that 554 // is not given, use the host from the request URL. 555 // 556 // Clean the host, in case it arrives with unexpected stuff in it. 557 host := cleanHost(r.Host) 558 if host == "" { 559 if r.URL == nil { 560 return errMissingHost 561 } 562 host = cleanHost(r.URL.Host) 563 } 564 565 // According to RFC 6874, an HTTP client, proxy, or other 566 // intermediary must remove any IPv6 zone identifier attached 567 // to an outgoing URI. 568 host = removeZone(host) 569 570 ruri := r.URL.RequestURI() 571 if usingProxy && r.URL.Scheme != "" && r.URL.Opaque == "" { 572 ruri = r.URL.Scheme + "://" + host + ruri 573 } else if r.Method == "CONNECT" && r.URL.Path == "" { 574 // CONNECT requests normally give just the host and port, not a full URL. 575 ruri = host 576 if r.URL.Opaque != "" { 577 ruri = r.URL.Opaque 578 } 579 } 580 if stringContainsCTLByte(ruri) { 581 return errors.New("net/http: can't write control character in Request.URL") 582 } 583 // TODO: validate r.Method too? At least it's less likely to 584 // come from an attacker (more likely to be a constant in 585 // code). 586 587 // Wrap the writer in a bufio Writer if it's not already buffered. 588 // Don't always call NewWriter, as that forces a bytes.Buffer 589 // and other small bufio Writers to have a minimum 4k buffer 590 // size. 591 var bw *bufio.Writer 592 if _, ok := w.(io.ByteWriter); !ok { 593 bw = bufio.NewWriter(w) 594 w = bw 595 } 596 597 _, err = fmt.Fprintf(w, "%s %s HTTP/1.1\r\n", valueOrDefault(r.Method, "GET"), ruri) 598 if err != nil { 599 return err 600 } 601 602 // Header lines 603 _, err = fmt.Fprintf(w, "Host: %s\r\n", host) 604 if err != nil { 605 return err 606 } 607 if trace != nil && trace.WroteHeaderField != nil { 608 trace.WroteHeaderField("Host", []string{host}) 609 } 610 611 // Use the defaultUserAgent unless the Header contains one, which 612 // may be blank to not send the header. 613 userAgent := defaultUserAgent 614 if r.Header.has("User-Agent") { 615 userAgent = r.Header.Get("User-Agent") 616 } 617 if userAgent != "" { 618 _, err = fmt.Fprintf(w, "User-Agent: %s\r\n", userAgent) 619 if err != nil { 620 return err 621 } 622 if trace != nil && trace.WroteHeaderField != nil { 623 trace.WroteHeaderField("User-Agent", []string{userAgent}) 624 } 625 } 626 627 // Process Body,ContentLength,Close,Trailer 628 tw, err := newTransferWriter(r) 629 if err != nil { 630 return err 631 } 632 err = tw.writeHeader(w, trace) 633 if err != nil { 634 return err 635 } 636 637 err = r.Header.writeSubset(w, reqWriteExcludeHeader, trace) 638 if err != nil { 639 return err 640 } 641 642 if extraHeaders != nil { 643 err = extraHeaders.write(w, trace) 644 if err != nil { 645 return err 646 } 647 } 648 649 _, err = io.WriteString(w, "\r\n") 650 if err != nil { 651 return err 652 } 653 654 if trace != nil && trace.WroteHeaders != nil { 655 trace.WroteHeaders() 656 } 657 658 // Flush and wait for 100-continue if expected. 659 if waitForContinue != nil { 660 if bw, ok := w.(*bufio.Writer); ok { 661 err = bw.Flush() 662 if err != nil { 663 return err 664 } 665 } 666 if trace != nil && trace.Wait100Continue != nil { 667 trace.Wait100Continue() 668 } 669 if !waitForContinue() { 670 r.closeBody() 671 return nil 672 } 673 } 674 675 if bw, ok := w.(*bufio.Writer); ok && tw.FlushHeaders { 676 if err := bw.Flush(); err != nil { 677 return err 678 } 679 } 680 681 // Write body and trailer 682 err = tw.writeBody(w) 683 if err != nil { 684 if tw.bodyReadError == err { 685 err = requestBodyReadError{err} 686 } 687 return err 688 } 689 690 if bw != nil { 691 return bw.Flush() 692 } 693 return nil 694 } 695 696 // requestBodyReadError wraps an error from (*Request).write to indicate 697 // that the error came from a Read call on the Request.Body. 698 // This error type should not escape the net/http package to users. 699 type requestBodyReadError struct{ error } 700 701 func idnaASCII(v string) (string, error) { 702 // TODO: Consider removing this check after verifying performance is okay. 703 // Right now punycode verification, length checks, context checks, and the 704 // permissible character tests are all omitted. It also prevents the ToASCII 705 // call from salvaging an invalid IDN, when possible. As a result it may be 706 // possible to have two IDNs that appear identical to the user where the 707 // ASCII-only version causes an error downstream whereas the non-ASCII 708 // version does not. 709 // Note that for correct ASCII IDNs ToASCII will only do considerably more 710 // work, but it will not cause an allocation. 711 if isASCII(v) { 712 return v, nil 713 } 714 return idna.Lookup.ToASCII(v) 715 } 716 717 // cleanHost cleans up the host sent in request's Host header. 718 // 719 // It both strips anything after '/' or ' ', and puts the value 720 // into Punycode form, if necessary. 721 // 722 // Ideally we'd clean the Host header according to the spec: 723 // https://tools.ietf.org/html/rfc7230#section-5.4 (Host = uri-host [ ":" port ]") 724 // https://tools.ietf.org/html/rfc7230#section-2.7 (uri-host -> rfc3986's host) 725 // https://tools.ietf.org/html/rfc3986#section-3.2.2 (definition of host) 726 // But practically, what we are trying to avoid is the situation in 727 // issue 11206, where a malformed Host header used in the proxy context 728 // would create a bad request. So it is enough to just truncate at the 729 // first offending character. 730 func cleanHost(in string) string { 731 if i := strings.IndexAny(in, " /"); i != -1 { 732 in = in[:i] 733 } 734 host, port, err := net.SplitHostPort(in) 735 if err != nil { // input was just a host 736 a, err := idnaASCII(in) 737 if err != nil { 738 return in // garbage in, garbage out 739 } 740 return a 741 } 742 a, err := idnaASCII(host) 743 if err != nil { 744 return in // garbage in, garbage out 745 } 746 return net.JoinHostPort(a, port) 747 } 748 749 // removeZone removes IPv6 zone identifier from host. 750 // E.g., "[fe80::1%en0]:8080" to "[fe80::1]:8080" 751 func removeZone(host string) string { 752 if !strings.HasPrefix(host, "[") { 753 return host 754 } 755 i := strings.LastIndex(host, "]") 756 if i < 0 { 757 return host 758 } 759 j := strings.LastIndex(host[:i], "%") 760 if j < 0 { 761 return host 762 } 763 return host[:j] + host[i:] 764 } 765 766 // ParseHTTPVersion parses a HTTP version string. 767 // "HTTP/1.0" returns (1, 0, true). 768 func ParseHTTPVersion(vers string) (major, minor int, ok bool) { 769 const Big = 1000000 // arbitrary upper bound 770 switch vers { 771 case "HTTP/1.1": 772 return 1, 1, true 773 case "HTTP/1.0": 774 return 1, 0, true 775 } 776 if !strings.HasPrefix(vers, "HTTP/") { 777 return 0, 0, false 778 } 779 dot := strings.Index(vers, ".") 780 if dot < 0 { 781 return 0, 0, false 782 } 783 major, err := strconv.Atoi(vers[5:dot]) 784 if err != nil || major < 0 || major > Big { 785 return 0, 0, false 786 } 787 minor, err = strconv.Atoi(vers[dot+1:]) 788 if err != nil || minor < 0 || minor > Big { 789 return 0, 0, false 790 } 791 return major, minor, true 792 } 793 794 func validMethod(method string) bool { 795 /* 796 Method = "OPTIONS" ; Section 9.2 797 | "GET" ; Section 9.3 798 | "HEAD" ; Section 9.4 799 | "POST" ; Section 9.5 800 | "PUT" ; Section 9.6 801 | "DELETE" ; Section 9.7 802 | "TRACE" ; Section 9.8 803 | "CONNECT" ; Section 9.9 804 | extension-method 805 extension-method = token 806 token = 1*<any CHAR except CTLs or separators> 807 */ 808 return len(method) > 0 && strings.IndexFunc(method, isNotToken) == -1 809 } 810 811 // NewRequest wraps NewRequestWithContext using the background context. 812 func NewRequest(method, url string, body io.Reader) (*Request, error) { 813 return NewRequestWithContext(context.Background(), method, url, body) 814 } 815 816 // NewRequestWithContext returns a new Request given a method, URL, and 817 // optional body. 818 // 819 // If the provided body is also an io.Closer, the returned 820 // Request.Body is set to body and will be closed by the Client 821 // methods Do, Post, and PostForm, and Transport.RoundTrip. 822 // 823 // NewRequestWithContext returns a Request suitable for use with 824 // Client.Do or Transport.RoundTrip. To create a request for use with 825 // testing a Server Handler, either use the NewRequest function in the 826 // net/http/httptest package, use ReadRequest, or manually update the 827 // Request fields. For an outgoing client request, the context 828 // controls the entire lifetime of a request and its response: 829 // obtaining a connection, sending the request, and reading the 830 // response headers and body. See the Request type's documentation for 831 // the difference between inbound and outbound request fields. 832 // 833 // If body is of type *bytes.Buffer, *bytes.Reader, or 834 // *strings.Reader, the returned request's ContentLength is set to its 835 // exact value (instead of -1), GetBody is populated (so 307 and 308 836 // redirects can replay the body), and Body is set to NoBody if the 837 // ContentLength is 0. 838 func NewRequestWithContext(ctx context.Context, method, url string, body io.Reader) (*Request, error) { 839 if method == "" { 840 // We document that "" means "GET" for Request.Method, and people have 841 // relied on that from NewRequest, so keep that working. 842 // We still enforce validMethod for non-empty methods. 843 method = "GET" 844 } 845 if !validMethod(method) { 846 return nil, fmt.Errorf("net/http: invalid method %q", method) 847 } 848 if ctx == nil { 849 return nil, errors.New("net/http: nil Context") 850 } 851 u, err := parseURL(url) // Just url.Parse (url is shadowed for godoc). 852 if err != nil { 853 return nil, err 854 } 855 rc, ok := body.(io.ReadCloser) 856 if !ok && body != nil { 857 rc = ioutil.NopCloser(body) 858 } 859 // The host's colon:port should be normalized. See Issue 14836. 860 u.Host = removeEmptyPort(u.Host) 861 req := &Request{ 862 ctx: ctx, 863 Method: method, 864 URL: u, 865 Proto: "HTTP/1.1", 866 ProtoMajor: 1, 867 ProtoMinor: 1, 868 Header: make(Header), 869 Body: rc, 870 Host: u.Host, 871 } 872 if body != nil { 873 switch v := body.(type) { 874 case *bytes.Buffer: 875 req.ContentLength = int64(v.Len()) 876 buf := v.Bytes() 877 req.GetBody = func() (io.ReadCloser, error) { 878 r := bytes.NewReader(buf) 879 return ioutil.NopCloser(r), nil 880 } 881 case *bytes.Reader: 882 req.ContentLength = int64(v.Len()) 883 snapshot := *v 884 req.GetBody = func() (io.ReadCloser, error) { 885 r := snapshot 886 return ioutil.NopCloser(&r), nil 887 } 888 case *strings.Reader: 889 req.ContentLength = int64(v.Len()) 890 snapshot := *v 891 req.GetBody = func() (io.ReadCloser, error) { 892 r := snapshot 893 return ioutil.NopCloser(&r), nil 894 } 895 default: 896 // This is where we'd set it to -1 (at least 897 // if body != NoBody) to mean unknown, but 898 // that broke people during the Go 1.8 testing 899 // period. People depend on it being 0 I 900 // guess. Maybe retry later. See Issue 18117. 901 } 902 // For client requests, Request.ContentLength of 0 903 // means either actually 0, or unknown. The only way 904 // to explicitly say that the ContentLength is zero is 905 // to set the Body to nil. But turns out too much code 906 // depends on NewRequest returning a non-nil Body, 907 // so we use a well-known ReadCloser variable instead 908 // and have the http package also treat that sentinel 909 // variable to mean explicitly zero. 910 if req.GetBody != nil && req.ContentLength == 0 { 911 req.Body = NoBody 912 req.GetBody = func() (io.ReadCloser, error) { return NoBody, nil } 913 } 914 } 915 916 return req, nil 917 } 918 919 // BasicAuth returns the username and password provided in the request's 920 // Authorization header, if the request uses HTTP Basic Authentication. 921 // See RFC 2617, Section 2. 922 func (r *Request) BasicAuth() (username, password string, ok bool) { 923 auth := r.Header.Get("Authorization") 924 if auth == "" { 925 return 926 } 927 return parseBasicAuth(auth) 928 } 929 930 // parseBasicAuth parses an HTTP Basic Authentication string. 931 // "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true). 932 func parseBasicAuth(auth string) (username, password string, ok bool) { 933 const prefix = "Basic " 934 // Case insensitive prefix match. See Issue 22736. 935 if len(auth) < len(prefix) || !strings.EqualFold(auth[:len(prefix)], prefix) { 936 return 937 } 938 c, err := base64.StdEncoding.DecodeString(auth[len(prefix):]) 939 if err != nil { 940 return 941 } 942 cs := string(c) 943 s := strings.IndexByte(cs, ':') 944 if s < 0 { 945 return 946 } 947 return cs[:s], cs[s+1:], true 948 } 949 950 // SetBasicAuth sets the request's Authorization header to use HTTP 951 // Basic Authentication with the provided username and password. 952 // 953 // With HTTP Basic Authentication the provided username and password 954 // are not encrypted. 955 // 956 // Some protocols may impose additional requirements on pre-escaping the 957 // username and password. For instance, when used with OAuth2, both arguments 958 // must be URL encoded first with url.QueryEscape. 959 func (r *Request) SetBasicAuth(username, password string) { 960 r.Header.Set("Authorization", "Basic "+basicAuth(username, password)) 961 } 962 963 // parseRequestLine parses "GET /foo HTTP/1.1" into its three parts. 964 func parseRequestLine(line string) (method, requestURI, proto string, ok bool) { 965 s1 := strings.Index(line, " ") 966 s2 := strings.Index(line[s1+1:], " ") 967 if s1 < 0 || s2 < 0 { 968 return 969 } 970 s2 += s1 + 1 971 return line[:s1], line[s1+1 : s2], line[s2+1:], true 972 } 973 974 var textprotoReaderPool sync.Pool 975 976 func newTextprotoReader(br *bufio.Reader) *textproto.Reader { 977 if v := textprotoReaderPool.Get(); v != nil { 978 tr := v.(*textproto.Reader) 979 tr.R = br 980 return tr 981 } 982 return textproto.NewReader(br) 983 } 984 985 func putTextprotoReader(r *textproto.Reader) { 986 r.R = nil 987 textprotoReaderPool.Put(r) 988 } 989 990 // ReadRequest reads and parses an incoming request from b. 991 // 992 // ReadRequest is a low-level function and should only be used for 993 // specialized applications; most code should use the Server to read 994 // requests and handle them via the Handler interface. ReadRequest 995 // only supports HTTP/1.x requests. For HTTP/2, use golang.org/x/net/http2. 996 func ReadRequest(b *bufio.Reader) (*Request, error) { 997 return readRequest(b, deleteHostHeader) 998 } 999 1000 // Constants for readRequest's deleteHostHeader parameter. 1001 const ( 1002 deleteHostHeader = true 1003 keepHostHeader = false 1004 ) 1005 1006 func readRequest(b *bufio.Reader, deleteHostHeader bool) (req *Request, err error) { 1007 tp := newTextprotoReader(b) 1008 req = new(Request) 1009 1010 // First line: GET /index.html HTTP/1.0 1011 var s string 1012 if s, err = tp.ReadLine(); err != nil { 1013 return nil, err 1014 } 1015 defer func() { 1016 putTextprotoReader(tp) 1017 if err == io.EOF { 1018 err = io.ErrUnexpectedEOF 1019 } 1020 }() 1021 1022 var ok bool 1023 req.Method, req.RequestURI, req.Proto, ok = parseRequestLine(s) 1024 if !ok { 1025 return nil, &badStringError{"malformed HTTP request", s} 1026 } 1027 if !validMethod(req.Method) { 1028 return nil, &badStringError{"invalid method", req.Method} 1029 } 1030 rawurl := req.RequestURI 1031 if req.ProtoMajor, req.ProtoMinor, ok = ParseHTTPVersion(req.Proto); !ok { 1032 return nil, &badStringError{"malformed HTTP version", req.Proto} 1033 } 1034 1035 // CONNECT requests are used two different ways, and neither uses a full URL: 1036 // The standard use is to tunnel HTTPS through an HTTP proxy. 1037 // It looks like "CONNECT www.google.com:443 HTTP/1.1", and the parameter is 1038 // just the authority section of a URL. This information should go in req.URL.Host. 1039 // 1040 // The net/rpc package also uses CONNECT, but there the parameter is a path 1041 // that starts with a slash. It can be parsed with the regular URL parser, 1042 // and the path will end up in req.URL.Path, where it needs to be in order for 1043 // RPC to work. 1044 justAuthority := req.Method == "CONNECT" && !strings.HasPrefix(rawurl, "/") 1045 if justAuthority { 1046 rawurl = "http://" + rawurl 1047 } 1048 1049 if req.URL, err = url.ParseRequestURI(rawurl); err != nil { 1050 return nil, err 1051 } 1052 1053 if justAuthority { 1054 // Strip the bogus "http://" back off. 1055 req.URL.Scheme = "" 1056 } 1057 1058 // Subsequent lines: Key: value. 1059 mimeHeader, err := tp.ReadMIMEHeader() 1060 if err != nil { 1061 return nil, err 1062 } 1063 req.Header = Header(mimeHeader) 1064 1065 // RFC 7230, section 5.3: Must treat 1066 // GET /index.html HTTP/1.1 1067 // Host: www.google.com 1068 // and 1069 // GET http://www.google.com/index.html HTTP/1.1 1070 // Host: doesntmatter 1071 // the same. In the second case, any Host line is ignored. 1072 req.Host = req.URL.Host 1073 if req.Host == "" { 1074 req.Host = req.Header.get("Host") 1075 } 1076 if deleteHostHeader { 1077 delete(req.Header, "Host") 1078 } 1079 1080 fixPragmaCacheControl(req.Header) 1081 1082 req.Close = shouldClose(req.ProtoMajor, req.ProtoMinor, req.Header, false) 1083 1084 err = readTransfer(req, b) 1085 if err != nil { 1086 return nil, err 1087 } 1088 1089 if req.isH2Upgrade() { 1090 // Because it's neither chunked, nor declared: 1091 req.ContentLength = -1 1092 1093 // We want to give handlers a chance to hijack the 1094 // connection, but we need to prevent the Server from 1095 // dealing with the connection further if it's not 1096 // hijacked. Set Close to ensure that: 1097 req.Close = true 1098 } 1099 return req, nil 1100 } 1101 1102 // MaxBytesReader is similar to io.LimitReader but is intended for 1103 // limiting the size of incoming request bodies. In contrast to 1104 // io.LimitReader, MaxBytesReader's result is a ReadCloser, returns a 1105 // non-EOF error for a Read beyond the limit, and closes the 1106 // underlying reader when its Close method is called. 1107 // 1108 // MaxBytesReader prevents clients from accidentally or maliciously 1109 // sending a large request and wasting server resources. 1110 func MaxBytesReader(w ResponseWriter, r io.ReadCloser, n int64) io.ReadCloser { 1111 return &maxBytesReader{w: w, r: r, n: n} 1112 } 1113 1114 type maxBytesReader struct { 1115 w ResponseWriter 1116 r io.ReadCloser // underlying reader 1117 n int64 // max bytes remaining 1118 err error // sticky error 1119 } 1120 1121 func (l *maxBytesReader) Read(p []byte) (n int, err error) { 1122 if l.err != nil { 1123 return 0, l.err 1124 } 1125 if len(p) == 0 { 1126 return 0, nil 1127 } 1128 // If they asked for a 32KB byte read but only 5 bytes are 1129 // remaining, no need to read 32KB. 6 bytes will answer the 1130 // question of the whether we hit the limit or go past it. 1131 if int64(len(p)) > l.n+1 { 1132 p = p[:l.n+1] 1133 } 1134 n, err = l.r.Read(p) 1135 1136 if int64(n) <= l.n { 1137 l.n -= int64(n) 1138 l.err = err 1139 return n, err 1140 } 1141 1142 n = int(l.n) 1143 l.n = 0 1144 1145 // The server code and client code both use 1146 // maxBytesReader. This "requestTooLarge" check is 1147 // only used by the server code. To prevent binaries 1148 // which only using the HTTP Client code (such as 1149 // cmd/go) from also linking in the HTTP server, don't 1150 // use a static type assertion to the server 1151 // "*response" type. Check this interface instead: 1152 type requestTooLarger interface { 1153 requestTooLarge() 1154 } 1155 if res, ok := l.w.(requestTooLarger); ok { 1156 res.requestTooLarge() 1157 } 1158 l.err = errors.New("http: request body too large") 1159 return n, l.err 1160 } 1161 1162 func (l *maxBytesReader) Close() error { 1163 return l.r.Close() 1164 } 1165 1166 func copyValues(dst, src url.Values) { 1167 for k, vs := range src { 1168 for _, value := range vs { 1169 dst.Add(k, value) 1170 } 1171 } 1172 } 1173 1174 func parsePostForm(r *Request) (vs url.Values, err error) { 1175 if r.Body == nil { 1176 err = errors.New("missing form body") 1177 return 1178 } 1179 ct := r.Header.Get("Content-Type") 1180 // RFC 7231, section 3.1.1.5 - empty type 1181 // MAY be treated as application/octet-stream 1182 if ct == "" { 1183 ct = "application/octet-stream" 1184 } 1185 ct, _, err = mime.ParseMediaType(ct) 1186 switch { 1187 case ct == "application/x-www-form-urlencoded": 1188 var reader io.Reader = r.Body 1189 maxFormSize := int64(1<<63 - 1) 1190 if _, ok := r.Body.(*maxBytesReader); !ok { 1191 maxFormSize = int64(10 << 20) // 10 MB is a lot of text. 1192 reader = io.LimitReader(r.Body, maxFormSize+1) 1193 } 1194 b, e := ioutil.ReadAll(reader) 1195 if e != nil { 1196 if err == nil { 1197 err = e 1198 } 1199 break 1200 } 1201 if int64(len(b)) > maxFormSize { 1202 err = errors.New("http: POST too large") 1203 return 1204 } 1205 vs, e = url.ParseQuery(string(b)) 1206 if err == nil { 1207 err = e 1208 } 1209 case ct == "multipart/form-data": 1210 // handled by ParseMultipartForm (which is calling us, or should be) 1211 // TODO(bradfitz): there are too many possible 1212 // orders to call too many functions here. 1213 // Clean this up and write more tests. 1214 // request_test.go contains the start of this, 1215 // in TestParseMultipartFormOrder and others. 1216 } 1217 return 1218 } 1219 1220 // ParseForm populates r.Form and r.PostForm. 1221 // 1222 // For all requests, ParseForm parses the raw query from the URL and updates 1223 // r.Form. 1224 // 1225 // For POST, PUT, and PATCH requests, it also parses the request body as a form 1226 // and puts the results into both r.PostForm and r.Form. Request body parameters 1227 // take precedence over URL query string values in r.Form. 1228 // 1229 // For other HTTP methods, or when the Content-Type is not 1230 // application/x-www-form-urlencoded, the request Body is not read, and 1231 // r.PostForm is initialized to a non-nil, empty value. 1232 // 1233 // If the request Body's size has not already been limited by MaxBytesReader, 1234 // the size is capped at 10MB. 1235 // 1236 // ParseMultipartForm calls ParseForm automatically. 1237 // ParseForm is idempotent. 1238 func (r *Request) ParseForm() error { 1239 var err error 1240 if r.PostForm == nil { 1241 if r.Method == "POST" || r.Method == "PUT" || r.Method == "PATCH" { 1242 r.PostForm, err = parsePostForm(r) 1243 } 1244 if r.PostForm == nil { 1245 r.PostForm = make(url.Values) 1246 } 1247 } 1248 if r.Form == nil { 1249 if len(r.PostForm) > 0 { 1250 r.Form = make(url.Values) 1251 copyValues(r.Form, r.PostForm) 1252 } 1253 var newValues url.Values 1254 if r.URL != nil { 1255 var e error 1256 newValues, e = url.ParseQuery(r.URL.RawQuery) 1257 if err == nil { 1258 err = e 1259 } 1260 } 1261 if newValues == nil { 1262 newValues = make(url.Values) 1263 } 1264 if r.Form == nil { 1265 r.Form = newValues 1266 } else { 1267 copyValues(r.Form, newValues) 1268 } 1269 } 1270 return err 1271 } 1272 1273 // ParseMultipartForm parses a request body as multipart/form-data. 1274 // The whole request body is parsed and up to a total of maxMemory bytes of 1275 // its file parts are stored in memory, with the remainder stored on 1276 // disk in temporary files. 1277 // ParseMultipartForm calls ParseForm if necessary. 1278 // After one call to ParseMultipartForm, subsequent calls have no effect. 1279 func (r *Request) ParseMultipartForm(maxMemory int64) error { 1280 if r.MultipartForm == multipartByReader { 1281 return errors.New("http: multipart handled by MultipartReader") 1282 } 1283 if r.Form == nil { 1284 err := r.ParseForm() 1285 if err != nil { 1286 return err 1287 } 1288 } 1289 if r.MultipartForm != nil { 1290 return nil 1291 } 1292 1293 mr, err := r.multipartReader(false) 1294 if err != nil { 1295 return err 1296 } 1297 1298 f, err := mr.ReadForm(maxMemory) 1299 if err != nil { 1300 return err 1301 } 1302 1303 if r.PostForm == nil { 1304 r.PostForm = make(url.Values) 1305 } 1306 for k, v := range f.Value { 1307 r.Form[k] = append(r.Form[k], v...) 1308 // r.PostForm should also be populated. See Issue 9305. 1309 r.PostForm[k] = append(r.PostForm[k], v...) 1310 } 1311 1312 r.MultipartForm = f 1313 1314 return nil 1315 } 1316 1317 // FormValue returns the first value for the named component of the query. 1318 // POST and PUT body parameters take precedence over URL query string values. 1319 // FormValue calls ParseMultipartForm and ParseForm if necessary and ignores 1320 // any errors returned by these functions. 1321 // If key is not present, FormValue returns the empty string. 1322 // To access multiple values of the same key, call ParseForm and 1323 // then inspect Request.Form directly. 1324 func (r *Request) FormValue(key string) string { 1325 if r.Form == nil { 1326 r.ParseMultipartForm(defaultMaxMemory) 1327 } 1328 if vs := r.Form[key]; len(vs) > 0 { 1329 return vs[0] 1330 } 1331 return "" 1332 } 1333 1334 // PostFormValue returns the first value for the named component of the POST, 1335 // PATCH, or PUT request body. URL query parameters are ignored. 1336 // PostFormValue calls ParseMultipartForm and ParseForm if necessary and ignores 1337 // any errors returned by these functions. 1338 // If key is not present, PostFormValue returns the empty string. 1339 func (r *Request) PostFormValue(key string) string { 1340 if r.PostForm == nil { 1341 r.ParseMultipartForm(defaultMaxMemory) 1342 } 1343 if vs := r.PostForm[key]; len(vs) > 0 { 1344 return vs[0] 1345 } 1346 return "" 1347 } 1348 1349 // FormFile returns the first file for the provided form key. 1350 // FormFile calls ParseMultipartForm and ParseForm if necessary. 1351 func (r *Request) FormFile(key string) (multipart.File, *multipart.FileHeader, error) { 1352 if r.MultipartForm == multipartByReader { 1353 return nil, nil, errors.New("http: multipart handled by MultipartReader") 1354 } 1355 if r.MultipartForm == nil { 1356 err := r.ParseMultipartForm(defaultMaxMemory) 1357 if err != nil { 1358 return nil, nil, err 1359 } 1360 } 1361 if r.MultipartForm != nil && r.MultipartForm.File != nil { 1362 if fhs := r.MultipartForm.File[key]; len(fhs) > 0 { 1363 f, err := fhs[0].Open() 1364 return f, fhs[0], err 1365 } 1366 } 1367 return nil, nil, ErrMissingFile 1368 } 1369 1370 func (r *Request) expectsContinue() bool { 1371 return hasToken(r.Header.get("Expect"), "100-continue") 1372 } 1373 1374 func (r *Request) wantsHttp10KeepAlive() bool { 1375 if r.ProtoMajor != 1 || r.ProtoMinor != 0 { 1376 return false 1377 } 1378 return hasToken(r.Header.get("Connection"), "keep-alive") 1379 } 1380 1381 func (r *Request) wantsClose() bool { 1382 if r.Close { 1383 return true 1384 } 1385 return hasToken(r.Header.get("Connection"), "close") 1386 } 1387 1388 func (r *Request) closeBody() { 1389 if r.Body != nil { 1390 r.Body.Close() 1391 } 1392 } 1393 1394 func (r *Request) isReplayable() bool { 1395 if r.Body == nil || r.Body == NoBody || r.GetBody != nil { 1396 switch valueOrDefault(r.Method, "GET") { 1397 case "GET", "HEAD", "OPTIONS", "TRACE": 1398 return true 1399 } 1400 // The Idempotency-Key, while non-standard, is widely used to 1401 // mean a POST or other request is idempotent. See 1402 // https://golang.org/issue/19943#issuecomment-421092421 1403 if r.Header.has("Idempotency-Key") || r.Header.has("X-Idempotency-Key") { 1404 return true 1405 } 1406 } 1407 return false 1408 } 1409 1410 // outgoingLength reports the Content-Length of this outgoing (Client) request. 1411 // It maps 0 into -1 (unknown) when the Body is non-nil. 1412 func (r *Request) outgoingLength() int64 { 1413 if r.Body == nil || r.Body == NoBody { 1414 return 0 1415 } 1416 if r.ContentLength != 0 { 1417 return r.ContentLength 1418 } 1419 return -1 1420 } 1421 1422 // requestMethodUsuallyLacksBody reports whether the given request 1423 // method is one that typically does not involve a request body. 1424 // This is used by the Transport (via 1425 // transferWriter.shouldSendChunkedRequestBody) to determine whether 1426 // we try to test-read a byte from a non-nil Request.Body when 1427 // Request.outgoingLength() returns -1. See the comments in 1428 // shouldSendChunkedRequestBody. 1429 func requestMethodUsuallyLacksBody(method string) bool { 1430 switch method { 1431 case "GET", "HEAD", "DELETE", "OPTIONS", "PROPFIND", "SEARCH": 1432 return true 1433 } 1434 return false 1435 } 1436 1437 // requiresHTTP1 reports whether this request requires being sent on 1438 // an HTTP/1 connection. 1439 func (r *Request) requiresHTTP1() bool { 1440 return hasToken(r.Header.Get("Connection"), "upgrade") && 1441 strings.EqualFold(r.Header.Get("Upgrade"), "websocket") 1442 } 1443