net/http: set Content-Type header in Redirect

Setting the Content-Type header explicitly allows browsers to know what
the type of the content is. Otherwise, they have to guess the type from
the content itself, which could lead to unpredictable behavior, and
increases CPU usage.

Not setting the Content-Type despite writing a body may also trigger
unwanted warnings in user middleware, and make it more difficult to
resolve valid issues where the user forgets to set Content-Type in
some situations where it should be set.

There is some precedent for doing this in http.FileServer, which
sets "Content-Type" to "text/html; charset=utf-8" before writing
<pre><a href=...></a></pre> HTML.

Change-Id: I24286827bebf4da8adee9238b8c5a94d4069c8db
Reviewed-on: https://go-review.googlesource.com/50510
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

1 files changed, 8 insertions, 4 deletions

diff --git a/src/net/http/server.go b/src/net/http/server.go
index 2fa8ab23d8..d370be9ecd 100644
--- a/src/net/http/server.go
+++ b/src/net/http/server.go
@@ -2013,13 +2013,17 @@ func Redirect(w ResponseWriter, r *Request, url string, code int) {
 		}
 	}
 
-	w.Header().Set("Location", hexEscapeNonASCII(url))
-	w.WriteHeader(code)
-
 	// RFC 2616 recommends that a short note "SHOULD" be included in the
 	// response because older user agents may not understand 301/307.
 	// Shouldn't send the response for POST or HEAD; that leaves GET.
-	if r.Method == "GET" {
+	writeNote := r.Method == "GET"
+
+	w.Header().Set("Location", hexEscapeNonASCII(url))
+	if writeNote {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	}
+	w.WriteHeader(code)
+	if writeNote {
 		note := "<a href=\"" + htmlEscape(url) + "\">" + statusText[code] + "</a>.\n"
 		fmt.Fprintln(w, note)
 	}