IT40715: ACE ALWAYS CONCATENATES DUPLICATE HTTP INPUT HEADERS PER RFC 2616

APAR status

• Closed as program error.

Error description

• When a HTTP request contains multiple headers with the same name
  is received by the HTTPConnector or HTTPSConnector then RFC 2616
  specifies that these values should be treated as a single header
  whose value is the concatenation of all such headers.
  
  IIB v10 and below did not always respect this requirement of RFC
  2616. If the embedded listener was used then only the last
  header would be used, the node-wide listener would show this
  behaviour.
  
  To assist migration for customers that may be relying on this
  old behaviour, new options will be added to the HTTPConnector
  and HTTPSConnector that specify what behaviour should be used
  for duplicate headers.
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All users of the HTTPConnector or HTTPSConnector in IBM App
  Connect Enterprise.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  When a HTTP request contains multiple headers with the same name
  is received by the HTTPConnector or HTTPSConnector then RFC 2616
  specifies that these values should be treated as a single header
  whose value is the concatenation of all such headers.
  
  IIB v10 and below did not always respect this requirement of RFC
  2616. If the embedded listener was used then only the last
  header would be used, the node-wide listener would show this
  behaviour.
  
  To assist migration for customers that may be relying on this
  old behaviour, new options will be added to the HTTPConnector
  and HTTPSConnector that specify what behaviour should be used
  for duplicate headers.
  

Problem conclusion

• The HTTPConnector and HTTPSConnector sections of the
  server.conf.yaml and node.conf.yaml now expose a
  "DuplicateHeaderAction" property which can take any of the
  following values:
  
  * combineHeaders - The default value, headers are merged as per
  the RFC 2616 standard
  * useLastHeader - For compatibility with IIB v10, only the last
  value seen for the header will be used
  * useFirstHeader - Only the first value seen for the header will
  be used
  * errorOnDuplicate - An exception will be thrown if a header has
  more than one value
  
  Note that the value for this property must be the same in both
  the HTTPConnector and HTTPSConnector. If the values specified
  for this property on the different connectors are different then
  a BIP6603 warning will be issued and the value set on the
  HTTPSConnector will be used.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v11.0      11.0.0.20
  v12.0      12.0.7.0
  
  The latest available maintenance can be obtained from:
  http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
  
  If the maintenance level is not yet available,information on
  its planned availability can be found on:
  http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  APP CONNECT ENT

• Fixed component ID

  5724J0550

Applicable component levels