golang HTTP2 https测试POST变GET问题小记

概述

因为工作需要协助修改某个golang程序，添加双向认证。但是在调整的过程遇到一个HTTP POST请求变成GET诡异的问题，最后各种搜索，总算解决，博文记录，用于备忘。

代码

服务端

因工作内容，代码有删减，以下样例

package mainimport ("crypto/tls""crypto/x509""encoding/json""fmt""io""io/ioutil""log""math/rand""mime""mime/multipart""net/http""os""strings""time"
)func main() {mux := http.NewServeMux()mux.HandleFunc("/...", handleToken)mux.HandleFunc("/...", handleHandshake)mux.HandleFunc("/...", handleData)caCert, err := os.ReadFile("certs/root_cert.pem")if err != nil {log.Fatalf("Reading server certificate: %s", err)}caCertPool := x509.NewCertPool()if !caCertPool.AppendCertsFromPEM(caCert) {fmt.Print("AppendCertsFromPEM failured!!!")}// Create TLS configuration with the certificate of the servertlsConfig := &tls.Config{ClientCAs:  caCertPool, //载入验证客户端证书的根证书ClientAuth: tls.RequireAndVerifyClientCert, //设置需要客户端证书}h1s := &http.Server{Addr:      ":8008",Handler:   mux,TLSConfig: tlsConfig,}log.Fatal(h1s.ListenAndServeTLS("certs/server_cert.pem", "certs/server_key.pem"))
}...
...
...func handleToken(w http.ResponseWriter, r *http.Request) {log.Printf("Token......%s", r.Method)switch r.Method {case http.MethodPost:...case http.MethodDelete:...default:http.Error(w, "400 Unsupport Method", http.StatusBadRequest)}}func handleHandshake(w http.ResponseWriter, r *http.Request) {.....
}

客户端

func GetToken(client http.Client) error {authData := ...jsonStr, _ := json.Marshal(authData)resp, err := client.Post(srv+url, "application/json", bytes.NewBuffer(jsonStr))if err != nil {log.Printf("Failed get token: err:%s \n", err)return err}defer resp.Body.Close()....return nil
}func main() {... client := http.Client{}// Create a pool with the server certificate since it is not signed// by a known CAcaCert, err := os.ReadFile("certs/root_cert.pem")if err != nil {log.Fatalf("Reading server certificate: %s", err)}caCertPool := x509.NewCertPool()caCertPool.AppendCertsFromPEM(caCert)clientCert, err := tls.LoadX509KeyPair("certs/client_cert.pem", "certs/client_key.pem")if err != nil {panic(err)}// Create TLS configuration with the certificate of the servertlsConfig := &tls.Config{RootCAs:            caCertPool,Certificates:       []tls.Certificate{clientCert},InsecureSkipVerify: true, //真实证书的情况下，需要删除该行，自签名可以保留}client.Transport = &http2.Transport{TLSClientConfig: tlsConfig}GetToken(client)
}

Q&A

Q：GetToken发起请求Post请求在服务端收到变成了GET
A：后面经过排查，根源是URL拼接的时候，中间多了一个“/”字符串，原本URL https://127.0.0.1:8008/api/token错误拼接成https://127.0.0.1:8008//api/token，从而在服务器端触发了301响应，go的http client在处理301响应的时候，将POST方法改成GET重新提交，所以导致服务端收到的请求方法是GET而不是POST

对应代码位于client.go

// redirectBehavior describes what should happen when the
// client encounters a 3xx status code from the server.
func redirectBehavior(reqMethod string, resp *Response, ireq *Request) (redirectMethod string, shouldRedirect, includeBody bool) {switch resp.StatusCode {case 301, 302, 303:redirectMethod = reqMethodshouldRedirect = trueincludeBody = false// RFC 2616 allowed automatic redirection only with GET and// HEAD requests. RFC 7231 lifts this restriction, but we still// restrict other methods to GET to maintain compatibility.// See Issue 18570.if reqMethod != "GET" && reqMethod != "HEAD" {redirectMethod = "GET"}

Q：go run 执行程序，报以下错误

/usr/local/go/pkg/tool/linux_arm64/link: running gcc failed: exit status 1
/usr/bin/ld: 找不到 -l***
collect2: 错误：ld 返回 1

A：因为程序内部通过cgo调用了第三方的动态库，而该动态库又没有在ldconfig或者系统默认目录下，所以找不到对应库导致编译出错，可以通过以下命令临时指定并执行

CGO_LDFLAGS="-L第三方动态库所在路径 -O2 -g" go run test.go

参考链接

Http Post请求被强制转换为Http Get请求
自签名根证书、中间证书、服务器证书生成流程详解