go - 为什么 go http post 得到的结果与 curl post 不同？

Question

我正在尝试实现 Rest API 登录流程。我已经用 curl 验证了这个过程。

使用 curl，以下命令将执行登录:

$ curl -i -X POST  https://the-service.mycompany.com/login -d username=<my username> -d password=<mypassword>
HTTP/1.1 200 Connection established

HTTP/1.1 302
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE, PUT, PATCH
Access-Control-Max-Age: 3600
Access-Control-Allow-Headers: x-requested-with, content-type, authorization, X-RateLimit-App, X-Spinnaker-Priority
Access-Control-Expose-Headers: X-AUTH-REDIRECT-URL
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Set-Cookie: SESSION=ODdmNGZjZmEtY2EwOC00YzA4LWFmMmYtMjAwNDI1ODM2NjI3; Path=/; HttpOnly; SameSite=Lax
Location: http://the-service.mycompany.com
Content-Length: 0
Date: Thu, 18 Jul 2019 14:38:40 GMT

此命令将成功并返回一个 cookie 作为响应。

但是当我尝试使用 Go 代码时:

http := http.Client{
}

const body = "username=myuser&password=mypass"
req, err := http.NewRequest("POST", "https://the-service.mycompany.com/login", strings.NewReader(body))
req.Header.Add("Accept", "*/*")
req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
req.Header.Del("Accept-Encoding")
dump, err := httputil.DumpRequestOut(req, true)
if err != nil {
    log.Fatal(err)
}

fmt.Printf("%q\n", dump)

resp, err := client.Do(req)

dump, err = httputil.DumpRequestOut(resp.Request, true)
if err != nil {
    log.Fatal(err)
}
fmt.Printf("%q\n", dump)

fmt.Println("Dump response ==================")
fmt.Println(resp.Status)
for k, v := range resp.Header {
    fmt.Printf("%s: %s\n", k, v)
}

它返回的响应与 curl 得到的响应不同，这意味着响应 header 和正文都完全不同。

我注意到，curl 返回两个状态码，200 和 302。但是 go 代码的 resp.Status 是 200。

go 代码输出为:

"POST /login HTTP/1.1\r\nHost: the-service.mycompany.com\r\nUser-Agent: Go-http-client/1.1\r\nContent-Length: 36\r\nAccept: */*\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept-Encoding: gzip\r\n\r\nusername=myuser&password=mypass"
"GET /login HTTP/1.1\r\nHost: the-service.mycompany.com\r\nUser- Agent: Go-http-client/1.1\r\nAccept: */*\r\nContent-Type: application/x-www-form-urlencoded\r\nReferer: http://the-service.mycompany.com/login\r\nAccept-Encoding: gzip\r\n\r\n"
Dump response ==================
200 
Access-Control-Allow-Origin: [*]
Access-Control-Max-Age: [3600]
Cache-Control: [no-cache, no-store, max-age=0, must-revalidate]
Date: [Thu, 18 Jul 2019 14:53:07 GMT]
Access-Control-Allow-Credentials: [true]
Content-Type: [text/html;charset=UTF-8]
X-Xss-Protection: [1; mode=block]
Pragma: [no-cache]
X-Frame-Options: [DENY]
X-Content-Type-Options: [nosniff]
Access-Control-Allow-Headers: [x-requested-with, content-type, authorization, X-RateLimit-App, X-Spinnaker-Priority]
Access-Control-Expose-Headers: [X-AUTH-REDIRECT-URL]
Expires: [0]
Content-Length: [1324]
Access-Control-Allow-Methods: [POST, GET, OPTIONS, DELETE, PUT, PATCH]

从输出来看，在执行 post 之前，请求是一个 POST，但是在我转储 resp.Request 时，它变成了一个 GET，为什么？

Answer 1

终于找到问题所在了。让我做一个 self 回答，希望它能帮助 future 遇到类似问题的人。

实际上，在我的例子中，curl 没有自动重定向，因为我没有将 -L 选项与 curl 一起使用。但是 go POST 会自动重定向。

所以我添加了一个CheckRedirect函数来阻止重定向:

func check(req *http.Request, via []*http.Request) error {
    return http.ErrUseLastResponse
}

... in main() ...

    client := http.Client {
        CheckRedirect: check,
    }

然后 client.PostForm 返回与 curl 相同的 302 结果。