9

We've recently noticed a problem where some user agents would repeat the same POST request without the user actually physically triggering it twice.

After further study, we noticed this only happens when the request goes through our load balancer and when the server took a long time to process the request. A packet capture session eventually revealed that the load balancer drops the connection after a 5 minute timeout by sending a TCP Reset to the client; however, the client automatically resubmitted the request without user intervention.

We observed this behavior in Apache HTTP client for Java, Firefox and IE 8. (I cannot install other browsers to test.) This makes me think this behavior is part of the HTTP standard, but this is not very easy to google.

Also, it seems this only happen if the first request is submitted via a kept-alive TCP connection.

billc.cn
  • 7,187
  • 3
  • 39
  • 79
  • When an HTTP client uses HTTP keepalive, it tries to maintain the TCP connection between requests. But the client cannot be sure that the connection is ok. So when it receives RST it may think that the connection was dead even before the request was sent and sends the request again. BTW I'm not sure that it's a real reason, it's just a guess. – Vadim Nov 06 '13 at 22:47
  • @Den That's my guess as well. I hope someone could come up with the RFC that defines this. The HTTP/1.1 RFC seems to say this must not happen. – billc.cn Nov 07 '13 at 16:39
  • Please include the capture. – Brian White Feb 14 '14 at 17:55
  • See questions like "[Avoid duplicate POSTs with REST](http://stackoverflow.com/q/15159274/1347968)" or "[How to deal with timed out POST requests](http://stackoverflow.com/q/13316357/1347968)" to get some ideas how resubmitted requests can be handled. – siegi May 07 '16 at 06:19

1 Answers1

6

This is part of the HTTP 1.1 protocol to handle connections that are closed prematurely by servers.

http://www.w3.org/Protocols/rfc2616/rfc2616-sec8.html#sec8.2.4.

I experienced a similar situation whereby we had the same form posted a couple of times within milliseconds apart.

A packet capture via wireshark confirmed the retransmission by the browser and logs from the server indicated the arrival of the requests.

Also further investigation also revealed that the load balancer such as F5 have reported incidence of retransmission behavior. So it is worth checking with your load balancer vendor as well.

thiru
  • 96
  • 1
  • 4
  • 1
    I was led to believe that because POST is not an idempotent operation, it should not be retried automatically, but the condition you pointed out seems to be universal to all request methods. – billc.cn May 29 '14 at 15:37