Broken headers posting from applet

[Kieron Briggs]

Hi all,

I'm having an interesting problem doing a file upload post from a Java
applet. From most computers it works fine, but have run into some which
get a "400 Bad Request" from the server.

After much head scratching, I tcpdump'd some attempts and discovered
that the problem is that the request header is getting broken on the
offending machines. From a working machine the header is:

POST /the/url/here.jsp HTTP/1.1
Content-Type: multipart/form-data;
boundary="----=_Part_0_3408129.1098789350911"
cookie: JSESSIONID=953F35452482970C3AC4AA4DB608FEF4
User-Agent: Mozilla/4.0 (Windows XP 5.1) Java/1.4.2_04
Host: host.example.com

And from the broken one the header is:

POST /the/url/here.jsp HTTP/1.0
Content-Length: 50099
Content-Type: multipart/form-data;
User-Agent: Mozilla/4.0 (Windows 2000 5.0) Java/1.4.2_06
Host: host.example.com boundary="----=_Part_5_28453152.1098768389906"
cookie: JSESSIONID=57226B6D4FADFD8D24996AAED7D40C80

As you can see, the User-Agent and Host headers are getting inserted in
the middle of the wrapped Content-Type header. The odd thing is that
I've tried this with:

Mozilla/4.0 (Windows XP 5.1) Java/1.4.2_02
Mozilla/4.0 (Windows XP 5.1) Java/1.4.2_04
Mozilla/4.0 (Windows XP 5.1) Java/1.4.2_06

and it works. Mozilla/4.0 (Windows 2000 5.0) Java/1.4.2_06 doesn't; I'm
getting some more win2k boxes with different JRE versions tested and
will post the results when they come in.

The multipart content is being generated by the J2EE activation.jar and
mail.jar classes, same versions (loaded from server next to the applet
..jar) so there's no difference there. The relavent section of my code
is:

MimeMultipart post = new MimeMultipart("form-data");

/* ... call post.addBodyPart() a bunch of times ... */

HttpURLConnection conn = (HttpURLConnection)this.target.openConnection();
conn.setDoOutput(true);
conn.setRequestMethod("POST");
conn.setRequestProperty("Content-Type", post.getContentType());
conn.connect();
OutputStream out = conn.getOutputStream();
post.writeTo(out);
out.close();


I'm wondering how such a bug is possible with the same classes and JRE
release... has anyone else encountered such a problem, and did you find
any solution?


Thanks in advance,

Kieron Briggs

 

[Kieron Briggs]

I'm having an interesting problem doing a file upload post from a Java
applet. From most computers it works fine, but have run into some which
get a "400 Bad Request" from the server.

As an update: it now looks like the problem is the firewall. Machines
behind the firewall show the bug, a machine outside (in a DMZ) don't.
It's some kind of Microsoft firewall server with built-in proxying.
Apparently this brain-dead 'proxy' doesn't actually understand wrapped
headers in HTTP. OMFG.


Kieron Briggs