java - HTTPURLConnection 不遵循从 HTTP 到 HTTPS 的重定向

Question

我不明白为什么 Java 的 HttpURLConnection 不遵循从 HTTP 到 HTTPS URL 的 HTTP 重定向。我使用以下代码获取位于 https://httpstat.us/ 的页面:

import java.net.URL;
import java.net.HttpURLConnection;
import java.io.InputStream;

public class Tester {

    public static void main(String argv[]) throws Exception{
        InputStream is = null;

        try {
            String httpUrl = "http://httpstat.us/301";
            URL resourceUrl = new URL(httpUrl);
            HttpURLConnection conn = (HttpURLConnection)resourceUrl.openConnection();
            conn.setConnectTimeout(15000);
            conn.setReadTimeout(15000);
            conn.connect();
            is = conn.getInputStream();
            System.out.println("Original URL: "+httpUrl);
            System.out.println("Connected to: "+conn.getURL());
            System.out.println("HTTP response code received: "+conn.getResponseCode());
            System.out.println("HTTP response message received: "+conn.getResponseMessage());
       } finally {
            if (is != null) is.close();
        }
    }
}

这个程序的输出是:

Original URL: http://httpstat.us/301
Connected to: http://httpstat.us/301
HTTP response code received: 301
HTTP response message received: Moved Permanently

A request to http://httpstat.us/301 returns the following (shortened) response (which seems absolutely right!):

HTTP/1.1 301 Moved Permanently
Cache-Control: private
Content-Length: 21
Content-Type: text/plain; charset=utf-8
Location: https://httpstat.us

很遗憾，Java 的 HttpURLConnection 不遵循重定向!

请注意，如果您将原始 URL 更改为 HTTPS (https://httpstat.us/301)，Java 将按预期遵循重定向!？

Answer 1

仅当它们使用相同的协议(protocol)时才会遵循重定向。 (参见源代码中的 the followRedirect() method。)无法禁用此检查。

尽管我们知道它反射(reflect)了 HTTP，但从 HTTP 协议(protocol)的角度来看，HTTPS 只是另一种完全不同的未知协议(protocol)。未经用户批准就跟随重定向是不安全的。

例如，假设应用程序设置为自动执行客户端身份验证。用户希望匿名上网，因为他使用的是 HTTP。但是，如果他的客户端在不询问的情况下使用 HTTPS，他的身份就会暴露给服务器。