From b302cf52761cc98d4ac4bedccaa80a0cec90be9d Mon Sep 17 00:00:00 2001
From: David Bateman <David.Bateman@edf.fr>
Date: Mon, 13 Apr 2026 11:13:52 +0200
Subject: [PATCH] No body in JsonUrlReader for GET method

---
 .../auth/openid/util/JsonUrlReader.java       | 23 +++++++++++--------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/util/JsonUrlReader.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/util/JsonUrlReader.java
index 8e3cd48b5..ef6b28fcc 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/util/JsonUrlReader.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/util/JsonUrlReader.java
@@ -72,16 +72,21 @@ public final class JsonUrlReader {
 
         try {
             HttpClient client = HttpClient.newHttpClient();
-            HttpRequest request = HttpRequest.newBuilder()
-                    .uri(uri)
-                    .header("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8")
-                    .method(method,
-                            HttpRequest.BodyPublishers.ofString(body == null ? "" : body, StandardCharsets.UTF_8))
-                    .build();
+            HttpRequest.Builder requestBuilder = HttpRequest.newBuilder().uri(uri);
+            if (method != "GET") {
+                // FIXME: If this function is ever used to post json bodies this header
+                // will need to be configurable
+                requestBuilder.header("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8")
+                .method(method, HttpRequest.BodyPublishers.ofString(body == null ? "" : body,
+                                                                    StandardCharsets.UTF_8));
+            }
+            else {
+                requestBuilder.GET();
+            }
 
-            // Asynchronous, non-blocking send, so that java servlet not blocked by outbound connection
-            CompletableFuture<HttpResponse<String>> future =
-                    client.sendAsync(request, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
+            // Asynchronous, non-blocking send, so that tomcat servlets are not blocked by outbound connection
+            CompletableFuture<HttpResponse<String>> future = client.sendAsync(requestBuilder.build(),
+                    HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
 
             HttpResponse<String> response = future.join();
             int status = response.statusCode();