Automatic redirection does not trigger the interceptor, causing the cookieJar interceptor to not work properly

[wilinz]

Package

dio, cookie_manager

Version

2.1.1

Output of flutter doctor -v

No response

Dart Version

No response

Steps to Reproduce

final dio = Dio();
final dir = await getApplicationSupportDirectory();
final cookieJar = PersistCookieJar(storage: FileStorage(join(dir.path, "cookies")));
dio.interceptors.add(CookieManager(cookieJar));
dio.get("http://site1") ; // This is a 302 redirect url. The redirected site2 url will return the set-cookie response header

Expected Result

The cookie will be saved to site2

Actual Result

The cookie is saved to the original url, ie site1, resulting in no cookie being carried in subsequent requests.
So I checked the source code cookie_mgr.dart, Should response.requestOptions.uri be changed to response.realUri?

  Future<void> _saveCookies(Response response) async {
    final setCookies = response.headers[HttpHeaders.setCookieHeader];

    if (setCookies != null) {
      final cookies = setCookies
          .map((str) => str.split(_setCookieReg))
          .expand((element) => element);
      await cookieJar.saveFromResponse(
        response.requestOptions.uri, // Should this be changed to response.realUri ?
        cookies.map((str) => Cookie.fromSetCookieValue(str)).toList(),
      );
    }
  }

[wilinz]

This seems to be caused by the fact that the interceptor cannot intercept the redirection. Is this a BUG?

[ueman]

This is not a bug. Redirects don‘t trigger interceptors since redirects are handled by the underlying APIs dio is making use of.

We should document this probably better since I feel like I’ve seen this question popular multiple times.

[AlexV525]

The inspector is working as intended, but we need to evaluate if the cookie manager is behaving normally.

[CaiJingLong]

This is not a bug. Redirects don‘t trigger interceptors since redirects are handled by the underlying APIs dio is making use of.

We should document this probably better since I feel like I’ve seen this question popular multiple times.

So, should dio handle redirection instead of handing it to the underlying api?

[ueman]

So, should dio handle redirection instead of handing it to the underlying api?

While it seems to be possible, I don't think it should, since that creates a lot of complexity. What we could offer is to allow the user to handle redirects himself.

[wilinz]

Below is my temporary solution, it works fine for now:

      dio.setFollowRedirects(false);
      // The cookieJar interceptor must precede the redirect interceptor
      dio.interceptors.add(CookieManager(cookieJar));
      dio.interceptors.add(RedirectInterceptor(dio));

extension DioExt on Dio {
  Dio setFollowRedirects(bool followRedirects) {
    options.followRedirects = followRedirects;
    if (followRedirects) {
      options.validateStatus =
          (int? status) => status != null && status >= 200 && status < 300;
    } else {
      options.validateStatus =
          (int? status) => status != null && status >= 200 && status < 400;
    }
    return this;
  }
}

class RedirectInterceptor extends Interceptor {
  final Dio dio;

  RedirectInterceptor(this.dio);

  @override
  Future<void> onResponse(
      Response response, ResponseInterceptorHandler handler) async {
    if (_isRedirect(response.statusCode ?? 0)) {
      final location = response.headers.value('location');
      if (location == null) throw Exception("Redirect location is null");
      final requestOptions = response.requestOptions;
      final rawUri = requestOptions.uri.toString();

      final redirectResponse = await dio.get(
        _parseHttpLocation(rawUri, location),
        options: Options(
          sendTimeout: requestOptions.sendTimeout,
          receiveTimeout: requestOptions.receiveTimeout,
          extra: requestOptions.extra,
          headers: requestOptions.headers,
          responseType: requestOptions.responseType,
          contentType: requestOptions.contentType,
          validateStatus: requestOptions.validateStatus,
          receiveDataWhenStatusError: requestOptions.receiveDataWhenStatusError,
          followRedirects: requestOptions.followRedirects,
          maxRedirects: requestOptions.maxRedirects,
          persistentConnection: requestOptions.persistentConnection,
          requestEncoder: requestOptions.requestEncoder,
          responseDecoder: requestOptions.responseDecoder,
          listFormat: requestOptions.listFormat,
        ),
      );
      return handler.next(redirectResponse);
    }
    return handler.next(response);
  }

  bool _isRedirect(int statusCode) {
    return statusCode == 301 ||
        statusCode == 302 ||
        statusCode == 303 ||
        statusCode == 307 ||
        statusCode == 308;
  }

  String _parseHttpLocation(final String rawUri, final String location) {
    var location1 = location;
    String uri;
    if (!location1.contains("://")) {
      final schemaEndIndex = rawUri.indexOf("://") + 3;
      var index = location1.startsWith("/")
          ? rawUri.indexOf("/", schemaEndIndex)
          : rawUri.substring(schemaEndIndex).lastIndexOf("/") + schemaEndIndex;
      if (index == -1) index = rawUri.length - 1;
      var baseUrl = rawUri.substring(0, index + 1);
      if (baseUrl.endsWith("/")) {
        baseUrl = baseUrl.substring(0, baseUrl.length - 1);
      }
      if (location1.startsWith("/")) {
        location1 = location1.substring(1);
      }
      uri = baseUrl + "/" + location1;
    } else {
      uri = location1;
    }
    return uri;
  }
  
}