Remove Content-Type Header when request with empty body POST method

[jay-choe]

Hi.

I have looked this issue and got an idea to deal with.

In current code, convert null body to not null and it write to outputstream.

In that process, when writing empty string in outputstream, unwanted Content-Type Header is added which is ''application/x-www-form-urlencoded".

So, I rearrange null body code to avoid unwanted header.

With this, Content-Length header is not set, so I added. But, this header is restricted header so 'sun.net.http.allowRestrictedHeaders' system property should be true to add content-length header.

And this property should be set before client class loaded. I guess there is no suitable way to inject restricted header to connection.

Feel Free to comment this idea. thanks.

[kdavisk6]

This look good. Could you please add some information to the README to indicate how to take advantage of this change, helping folks understand the System Property requirement?

[jay-choe]

@kdavisk6 sure, I added it.

[velo]

@jay-choe @kdavisk6 FWIW, I have rebased this PR after the formatting changes I did on master

[zoomout]

@velo
Please revert this change. Setting "sun.net.http.allowRestrictedHeaders" is breaking security.
restrictedHeaders include e.g. Host, enabling CSRF attack.

private static final String[] restrictedHeaders = {
    /* Restricted by XMLHttpRequest2 */
    //"Accept-Charset",
    //"Accept-Encoding",
    "Access-Control-Request-Headers",
    "Access-Control-Request-Method",
    "Connection", /* close is allowed */
    "Content-Length",
    //"Cookie",
    //"Cookie2",
    "Content-Transfer-Encoding",
    //"Date",
    //"Expect",
    "Host",
    "Keep-Alive",
    "Origin",
    // "Referer",
    // "TE",
    "Trailer",
    "Transfer-Encoding",
    "Upgrade",
    //"User-Agent",
    "Via"
};

[velo]

Hello, good morning, how are you today?

Raise a PR with test case.

Thank you.

[evgeniycheban]

Hi @velo, this PR turned out into a breaking change for us, currently we have some POST requests sent with no body, for example:

@PostMapping("/action/{actionId}")
String performAction(@PathVariable Long actionId);

it fails when the request goes through our gateway proxy which forces us to either send the request with an empty body
"{}" or implement an interceptor that would add "Content-Length": 0 header for POST requests with no body. I have looked at the code and this change also does not meet the initial requirement from gh-2068:

POST requests with no body should by default add Content-Length: 0 header (as described in https://github.com/OpenFeign/feign/issues/1229), but no Content-Type header.

We cannot use sun.net.http.allowRestrictedHeaders either due to environment restrictions and I also believe that setting this property could lead to potential security risks and Feign should not rely on it in order to be able to set "Content-Length": 0, instead I think a new configuration option for Feign.Builder should be introduced that would enable an old behaviour by default to restore backward compatibility, I can also provide a PR for this and to address the initial gh-2068 issue.
What do you think?