ShopwareAG/shopware-4 — pull request #165 by svenmuennich (2014-06-27 09:52:01+00:00)
Title: Fix handling of HTTP 'Location' headers and status codes in REST API responses to POST and PUT requests

When using `POST` and `PUT` requests with the REST API, it always explicitly sets a HTTP `Location` header, when the requests succeed. This was done using the `setHeader()` method. The problem with this approach is twofold: Firstly the location header should only be set on successful `POST` requests, because only in these cases a new resource with a new location has been created. `PUT` requests on the other hand don't create new resources and hence don't result in new locations, the requesting party could be interested in (it is still contained in the response data, though). Secondly, using the `setHeader()` method only adds a new entry to the list of headers to be sent. These headers are later sent with PHP's `header()` method, which has, according to its documentation (http://www.php.net/manual/en/function.header.php), two special-case header calls. Important for this fix is the second one:
> The second special case is the "Location:" header. Not only does it send this header back to the browser, but it also returns a REDIRECT (302) status code to the browser unless the 201 or a 3xx status code has already been set.

This behavior is responsible for the problem, that Shopware's REST API always returns a `302` in case of a successful `PUT` or `POST` request. To fix this, I replaced each `setHeader()` call for `POST` requests with the more meaningful `setRedirect()` call, which accepts a status code as an optional parameter. When passing a `201` for the status code, PHP's `header()` method will, as described in the docs, not replace the already set `201` with a `302` by setting the `Location` header. Furthermore I remove all calls to `setHeader()` for `PUT` requests completely. Now a successful `POST` request will result in a `HTTP/1.1 201 Created`, while a successful `PUT` request will result in a `HTTP/1.1 200 OK`.