From 90ea46f3e0296f3f5608d63601f5bad3ca2b33b5 Mon Sep 17 00:00:00 2001
From: Dalton Lang <35282898+GrammAcc@users.noreply.github.com>
Date: Sat, 27 Apr 2024 16:21:21 -0500
Subject: [PATCH] [HTTPRequest] Add Missing Redirect Status Codes

---
 scene/main/http_request.cpp | 20 ++++++++++++++++++--
 scene/main/http_request.h   |  1 +
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/scene/main/http_request.cpp b/scene/main/http_request.cpp
index ec3b6dabb8..20c2b84afa 100644
--- a/scene/main/http_request.cpp
+++ b/scene/main/http_request.cpp
@@ -231,6 +231,22 @@ Error HTTPRequest::_get_redirect_headers(Vector<String> *r_headers) {
 	return OK;
 }
 
+bool HTTPRequest::_is_automatic_redirect() const {
+	if (unlikely(method == HTTPClient::METHOD_CONNECT)) {
+		// Never automatically redirect CONNECT requests.
+		return false;
+	} else if (response_code == 301 || response_code == 302 || response_code == 303 || response_code == 305) {
+		// We change unsafe methods to GET for 301, 302, and 303, so these are always redirected.
+		// 305 is deprecated and treated as equivalent to 302.
+		return true;
+	} else if ((response_code == 307 || response_code == 308) && _is_method_safe()) {
+		// We only automatically redirect for safe methods on method-preserving status codes.
+		return true;
+	} else {
+		return false;
+	}
+}
+
 bool HTTPRequest::_handle_response(bool *ret_value) {
 	if (!client->has_response()) {
 		_defer_done(RESULT_NO_RESPONSE, 0, PackedStringArray(), PackedByteArray());
@@ -251,8 +267,8 @@ bool HTTPRequest::_handle_response(bool *ret_value) {
 		response_headers.push_back(E);
 	}
 
-	if (response_code == 301 || response_code == 302) {
-		// Handle redirect.
+	if (_is_automatic_redirect()) {
+		// Follow redirect.
 
 		if (max_redirects >= 0 && redirections >= max_redirects) {
 			_defer_done(RESULT_REDIRECT_LIMIT_REACHED, response_code, response_headers, PackedByteArray());
diff --git a/scene/main/http_request.h b/scene/main/http_request.h
index 6188d5d9a1..d51fb02079 100644
--- a/scene/main/http_request.h
+++ b/scene/main/http_request.h
@@ -105,6 +105,7 @@ private:
 	bool _is_content_header(const String &p_header) const;
 	bool _is_method_safe() const;
 	Error _get_redirect_headers(Vector<String> *r_headers);
+	bool _is_automatic_redirect() const;
 
 	bool _handle_response(bool *ret_value);