net/http: NewRequest() defaults to GET if url contains double slash (//)

[WestleyK]

Go version

go version go1.23.4 linux/amd64

Output of go env in your module/workspace:

GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/home/westley/.cache/go-build'
GOENV='/home/westley/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/westley/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/westley/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/home/westley/go/pkg/mod/golang.org/[email protected]'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='go1.23.4+auto'
GOTOOLDIR='/home/westley/go/pkg/mod/golang.org/[email protected]/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.4'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/westley/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/home/westley/codes/go-http-post-bug/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3329322425=/tmp/go-build -gno-record-gcc-switches'

What did you do?

https://go.dev/play/p/qzbgg-0-v5T

Example Code

package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
	"testing"
	"time"
)

func TestMain(t *testing.T) {
	mux := http.NewServeMux()

	mux.Handle("/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		fmt.Fprintf(w, "Method: %s", r.Method)
	}))

	s := http.Server{Handler: mux, Addr: ":8000"}
	go func() {
		log.Fatalln(s.ListenAndServe())
	}()

	time.Sleep(time.Second)

	tests := []struct {
		name     string
		url      string
		expected string
	}{
		{name: "one_slash", url: "/test-something", expected: "Method: POST"},
		{name: "two_slash", url: "/test/something", expected: "Method: POST"},
		{name: "double_slash", url: "//test-something", expected: "Method: POST"},
		{name: "also_double", url: "/test//something", expected: "Method: POST"},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			testURL := "http://localhost:8000" + tt.url

			req, err := http.NewRequest("POST", testURL, nil)
			if err != nil {
				t.Fatal(err)
			}

			//t.Logf("Full request: %+v\n", req) // Always shows method POST

			resp, err := http.DefaultClient.Do(req)
			if err != nil {
				t.Fatal(err)
			}
			defer resp.Body.Close()

			body, err := io.ReadAll(resp.Body)
			if err != nil {
				t.Fatal(err)
			}

			if tt.expected != string(body) {
				t.Errorf("handler(%v) = %v, want = %v", testURL, string(body), tt.expected)
			}
		})
	}
}

http.NewRequest() overrides the method if the url contains a double slash (//).

What did you see happen?

Output from tests:

=== RUN   TestMain
=== RUN   TestMain/one_slash
=== RUN   TestMain/two_slash
=== RUN   TestMain/double_slash
    prog_test.go:60: handler(http://localhost:8000//test-something) = Method: GET, want = Method: POST
=== RUN   TestMain/also_double
    prog_test.go:60: handler(http://localhost:8000/test//something) = Method: GET, want = Method: POST
--- FAIL: TestMain (1.00s)
    --- PASS: TestMain/one_slash (0.00s)
    --- PASS: TestMain/two_slash (0.00s)
    --- FAIL: TestMain/double_slash (0.00s)
    --- FAIL: TestMain/also_double (0.00s)
FAIL

What did you expect to see?

It should still use the POST method as specified.

[gabyhelp]

Related Issues

• net/http: Double slash in request leads Method to always be GET #69063 (closed)
• net/http: request.Method is wrong when path start by // #29584 (closed)
• net/http: invalid http request methods accepted in NewRequest and NewRequestWithContext #44291 (closed)
• net/http: ServeMux not validating methods for redirected paths #69690 (closed)
• import/path: issue title #68253 (closed)
• net/http: Request method does not default to GET with http2 #31061 (closed)
• net/http: redirect with 308 rather than 301 #60769
• net/http: double escape of URL #25208 (closed)
• affected/package: http #59759 (closed)
• net/http: Pattern matching of ServeMux works weird and unexpected #70311 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[WestleyK]

Looks like this is duplicate of #69063