there is a strange situation for me when executing this code in Internet Explorer(11) and Flash Player 26.0.0.151, here are flex code
Flex Code:
<?xml version="1.0"?>
<mx:Application xmlns:mx="http://www.adobe.com/2006/mxml">
<mx:Script><![CDATA[
import mx.rpc.events.FaultEvent;
import mx.rpc.events.ResultEvent;
import mx.rpc.http.HTTPService;
private function loginUser():void {
var http:HTTPService = new HTTPService();
http.url = "http://localhost/flex_test/redirect.php";
trace("calling login url " + http.url);
http.method = "POST";
http.addEventListener(ResultEvent.RESULT, loginSuccessHandler);
http.addEventListener(FaultEvent.FAULT, loginFailureHandler);
var req:URLVariables = new URLVariables();
req.j_username = "login";
req.j_password = "password";
http.request = req;
http.send();
}
private function loginSuccessHandler(event:ResultEvent):void {
trace("loginSuccessHandler");
var resultMsg:String = String(event.result);
resultLabel.text = resultMsg;
}
private function loginFailureHandler(event:FaultEvent):void {
trace("loginFailureHandler");
trace("HTTP login error: event=" + event);
resultLabel.text = "Error";
}
]]></mx:Script>
<mx:Button click="loginUser()" label="Say Hello"/>
<mx:Label id="resultLabel" text=""/>
</mx:Application>
PHP Code:
1) redirect.php
<?php
header('Location: http://localhost/flex_test/redirected.php');
exit;
2) redirected.php
<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
echo "goes POST";
} else {
echo "goes GET";
}
When using Internet Explorer and Flash Player 25.0.0.148 then everything seems to be OK and displayed message is "goes GET" Problem not occur in Firefox and Chrome even with Flash Player 26.0.0.151
Can You advice something how to resolve this issue - and any ideas why POST is send instead of GET in IE browser? Maybe this is connected to https://nvd.nist.gov/vuln/detail/CVE-2017-3085#vulnDescriptionTitle
but is this correct behavior to send POST after redirect, even when we modify code redirect.php to:
<?php
header('Location: http://plll0284/flex_test/redirected.php', true, 303);
exit;
Thanks for help