Issue with cyrillic symbols in location headers

[LavrovArtem]

To reproduce this bug, execute the code below and open http://localhost:777/ in the browser. This page redirects to a page from the location header, and browser should open http://localhost:777/?text=что-то%20русское .

In node.js version 0.10.15 and earlier, it works fine, but io.js opens the http://localhost:777/?text=GB>-B>%20@CAA:>5 url.

I think that the issue is linked to the writeHead function that incorrectly encodes headers and sends them to the browser.

var http = require('http');

http.createServer(function(req, res) {
    if (req.url === '/')
        res.writeHead(302, {location:'?text=что-то русское'});

    res.end();
}).listen(777);

[vkurchatkin]

I'm not sure if this is a bug, but it is always better to encode url manually:

var http = require('http');

http.createServer(function(req, res) {
    if (req.url === '/')
        res.writeHead(302, {location:'?text=' + encodeURI('что-то русское')});

    res.end();
}).listen(7777);

[bnoordhuis]

As general advise, you're better off sticking to ASCII in HTTP headers. From RFC 7230:

Historically, HTTP has allowed field content with text in the ISO-8859-1 charset, supporting other charsets only through use of [RFC2047] encoding. In practice, most HTTP header field values use only a subset of the US-ASCII charset.

Neither MIME (RFC 2047) nor ISO-8859-1 are widely supported. ASCII is the safest bet.

[vkurchatkin]

Something like this happens: new Buffer('что-то русское', 'binary').toString()

[LavrovArtem]

I understand that it would be reasonable to encode cyrillic or go without using these symbols, but we are creating a proxy server, whereas even quite well-known sites are sending headers with cyrillic.

[rlidwka]

whereas even quite well-known sites are sending headers with cyrillic

Do you have an example of a such website? It might be useful to mention a real-life example in the respective test should that be written.

[vkurchatkin]

Adding res._send(''); forces headers to be flushed with correct encoding. Ironically, calling res.flushHeaders() doesn't really flush headers

[LavrovArtem]

@rlidwka
Take https://market.yandex.ru/
If you type cyrillic letters into the search box (say, "телефон"), the header will be like http://screencast.com/t/cKzbSW0a

[vkurchatkin]

Another workaround:

var http = require('http');

http.createServer(function(req, res) {
    if (req.url === '/') {
      res.statusCode = 302;
      res.setHeader('location', '?text=что-то русское');
      res.flushHeaders();
    }

    res.end();
}).listen(7777);

[ChALkeR]

@vkurchatkin Does that mean that response.writeHead behaves differently from response.setHeader? How that could be expected?

[ChALkeR]

@LavrovArtem Yandex.Market gives properly encoded url in the Location header for me.
What tool are you using on the screenshot? Maybe it decodes the Location header? Have you tried pressing the «[Raw]» button?

[ChALkeR]

Guess this link goes here: nodejs/node-v0.x-archive#25293

[LavrovArtem]

@ChALkeR I used Fiddler2 to view requests. Also, when I debug our proxy-server, I see the response coming from the original site with unencoded location header.

[LavrovArtem]

@vkurchatkin thank you for workarounds