question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

tus-sender: resolveUploadUrl does not work properly when Location header is relative

See original GitHub issue

Describe the bug 400 bad request response upon uploading when using the official tusdotnet server library.

To Reproduce Steps to reproduce the behavior:

  1. Clone https://github.com/tusdotnet/tusdotnet
  2. Run the AspNetCore_netcoreapp3.1_TestApp
  3. Use it as a destination: http://localhost:5006/files
  4. Check your browser’s network tab

Expected behavior There woudn’t be a 400 bad request response.

Versions 0.13.4, all browsers

Code

import React from "react";
import TusUploady from "@rpldy/tus-uploady";
import UploadButton from "@rpldy/upload-button";

export const Uploader = () =>
    (<TusUploady
    destination={{ url: "http://localhost:5006/files" }}
    chunkSize={2142880}
    featureDetection={true}
    >
    <UploadButton/>
</TusUploady>)

Solution I noticed tusdotnet returns the following Location header on the first POST request: /files/75fc454598bb4adca40a831ac62cbd13

The next PATCH request goes to the URL: http://localhost:5006/files/files/75fc454598bb4adca40a831ac62cbd13 – which obviously does not exist.

The issue is caused by resolveUploadUrl: https://github.com/rpldy/react-uploady/blob/52e71e9a5785df5c2d3eccd3605df733aa6af683/packages/core/tus-sender/src/tusSender/initTusUpload/createUpload.js#L12 specifically the else clause:

else {
        uploadUrl = [
            createUrl.replace(/\/$/, ""),
            location.replace(/^\//, "")
        ].join("/");
    }

Maybe the Location header response can just be appended to the URL, but I don’t know enough about this codebase or the tus ecosystem to verify whether that would work.

Issue Analytics

  • State:closed
  • Created 2 years ago
  • Comments:6

github_iconTop GitHub Comments

1reaction
gerwimcommented, Sep 29, 2021

@yoavniran Thanks for the quick fix! Can confirm it’s working. 👍

1reaction
gerwimcommented, Sep 28, 2021

Hi @yoavniran,

even when the header starts with “/” so it should be absolute and therefore avoid the duplicate “/files/files”.

Yes 😉

I dont understand where port 5000 came from.

I’m sorry, this is my mistake. I was debugging multiple versions of tusdotnet and had multiple projects. I’ve updated the description.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Location - HTTP - MDN Web Docs - Mozilla
Location is a header associated with the response, while Content-Location is associated with the entity returned. Header type, Response header.
Read more >
What's the proper way to set the Location header for an HTTP ...
My question is how do I translate that relative URL to the abosolute URL for the Location header in the proper way for...
Read more >
HTTP location - Wikipedia
The HTTP Location header field is returned in responses from an HTTP server under two circumstances: To ask a web browser to load...
Read more >
Relative location headers are "fixed" as if they are ... - GitHub
When the location header points to a relative address, werkzeug grabs the root of the url, which for example.com/a/b/c/d/e turns into example.
Read more >
Security concerns of user-provided relative URL in Location
Open Redirect. Where does the next value originally come from? POST requests are not generally vulnerable to open redirect.
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found