HTTP 303 Oracle ORDS

Question

I need to redirect the user to another endpoint after he make a POST, but the other endpoint accepts only GET requests.

As wiki says HTTP code 303 should tell the client to send a request to another location and change the method to GET:

If a server responds to a POST or other non-idempotent request with a 303 See Other response and a value for the location header, the client is expected to obtain the resource mentioned in the location header using the GET method (source).

But after the response the client redirects using POST again. I tested the endpoint with Insomnia and here is the timeline output:

* Preparing request to http://******:8080/ords/demo/llmob.test_post_david
* Current time is 2020-09-10T07:21:09.418Z
* Using libcurl/7.69.1 OpenSSL/1.1.1e zlib/1.2.11 brotli/1.0.7 libidn2/2.2.0 libssh2/1.9.0 nghttp2/1.29.0
* Using default HTTP version
* Disable timeout
* Enable automatic URL encoding
* Enable SSL validation
* Enable cookie sending with jar of 5 cookies
* Connection 21 seems to be dead!
* Closing connection 21
* Hostname ****** was found in DNS cache
*   Trying 192.168.254.135:8080...
* Connected to ****** (192.168.254.135) port 8080 (#22)

> POST /ords/demo/llmob.test_post_david HTTP/1.1
> Host: ******:8080
> User-Agent: insomnia/2020.3.3
> Access-Control-Allow-Origin: *
> Content-Type: multipart/form-data; boundary=X-INSOMNIA-BOUNDARY
> Accept: */*
> Content-Length: 433

| --X-INSOMNIA-BOUNDARY
| Content-Disposition: form-data; name="ShoppingCartID"
| 78


* We are completely uploaded and fine
* Mark bundle as not supporting multiuse

< HTTP/1.1 303 
< Location: http://******:8080/ords/devapex/sbas/r/self-check-out159/odobreno
< Transfer-Encoding: chunked
< Date: Thu, 10 Sep 2020 07:21:10 GMT


* Ignoring the response-body
* Received 5 B chunk
* Connection #22 to host ****** left intact
* Issue another request to this URL: 'http://******:8080/ords/devapex/sbas/r/self-check-out159/odobreno'
* Disables POST, goes with GET
* Found bundle for host ******: 0x1497368c8870 [serially]
* Can not multiplex, even if we wanted to!
* Re-using existing connection! (#22) with host ******
* Connected to ****** (192.168.254.135) port 8080 (#22)

> POST /ords/devapex/sbas/r/self-check-out159/odobreno HTTP/1.1
> Host: ******:8080
> User-Agent: insomnia/2020.3.3
> Access-Control-Allow-Origin: *
> Content-Type: multipart/form-data; boundary=X-INSOMNIA-BOUNDARY
> Accept: */*
> Content-Length: 433

| --X-INSOMNIA-BOUNDARY
| Content-Disposition: form-data; name="ShoppingCartID"
| 78

* We are completely uploaded and fine
* Mark bundle as not supporting multiuse

< HTTP/1.1 405 
< Allow: GET
< Content-Type: text/html
< Content-Length: 15798
< Date: Thu, 10 Sep 2020 07:21:10 GMT


* Received 7.9 KB chunk
* Received 7.5 KB chunk
* Connection #22 to host ****** left intact

The first response is generate with the OWA_UTIL package as follow:

 owa_util.status_line(
                         nstatus=> 303, bclose_header=> false
                         );
                         
   owa_util.redirect_url(
             curl         => 'http://******:8080/ords/devapex/sbas/r/self-check-out159/odobreno',
            bclose_header  =>TRUE
            );

ORDS version 18.4.

Update

When the same request is issued from the browser the response code is 403 (error below), and the redirect never happen.

The request cannot be processed because this resource does not support Cross Origin Sharing requests, or the request Origin is not authorized to access this resource. If ords is being reverse proxied ensure the front end server is propagating the host name, for mod_proxy ensure ProxyPreserveHost is set to On

Answer 1

If your endpoint that you trying to forward the user to is in the same host/module, you can use the :FORWARD_LOCATION implicit bind parameter that was introduced in ORDS 18.3.

If not, instead of using OWA_UTIL to set the new location the user should be redirected to, try using the ORDS response headers. I have an example of how to do this here.