IT11169: CONTENT-TYPE HEADER REMOVED FROM GET REQUESTS

Fix packs for DataPower XML Security Gateway version 6.0
Fix packs for DataPower B2B Appliance version 6.0
Fix packs for DataPower Integration Appliance version 6.0
Fix packs for DataPower Low Latency Appliance version 6.0
Fix packs for DataPower Service Gateway version 6.0
Fix packs for DataPower Service Gateway version 6.0.1
Fix packs for DataPower B2B Appliance version 6.0.1
Fix packs for DataPower Integration Appliance version 6.0.1
Fix packs for DataPower Service Gateway version 7.0
Fix packs for DataPower B2B Appliance version 7.0
Fix packs for DataPower Integration Appliance version 7.0
Fix packs for DataPower Gateway version 7.1
Fix packs for DataPower Gateway version 7.2

APAR status

• Closed as program error.

Error description

• Affected are customers running firmware versions containing
  APAR IC81982 fix who send GET requests with a content-type
  header.
  In such scenarios, customers will see the content-type header
  removed in processing prior to the request reaching the backend.
  

Local fix

• Consider using a single set variable action
  setvar INPUT var://service/append-request-header/content-type
  var://service/original-content-type to inject the header back
  into the request.
  

Problem summary

• Affected are all customers sending (or adding in processing) a
  Content-Type header with a GET request. Applies also for
  sending an empty POST request without the header.
  
  Since APAR IC81982, which is a part of the 6.0.0.0 release, the
  Content-Type header gets stripped from a GET or HEAD request
  before connecting to a backend.
  
  Since then, this approach has been proved too intrusive and
  although having the Content-Type header in a GET request has a
  very marginal use, it shouldn't be disallowed. It was also
  found not justifiable to add an artificial Content-Type header
  to a POST request that doesn't contain any message body.
  
  This APAR in fact supersedes APAR IC81982, fixing its original
  problem of injecting unwanted Content-Type header into
  requests with no content, while still allowing an incoming
  Content-Type header on such requests to pass through.
  
  Addendum: It turns out that in some cases the Content-Type
  header is being injected despite this APAR. Any customer
  experiencing such behavior is encouraged to use the following
  advice:
  https://developer.ibm.com/answers/questions/258570/how-to-avoid-
  injecting-content-type-for-get-reques/
  

Problem conclusion

• The fix is available in 6.0.0.17, 6.0.1.13, 7.0.0.10, 7.1.0.7
  and 7.2.0.2
  
  For a list of the latest fix packs available, please see:
  http://www-01.ibm.com/support/docview.wss?uid=swg21237631
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DATAPOWER

• Fixed component ID

  DP1234567

Applicable component levels

• R600 PSN

     UP

• R601 PSN

     UP

• R700 PSN

     UP

• R710 PSN

     UP

• R720 PSN

     UP