[issue33181] SimpleHTTPRequestHandler shouldn't redirect to directories with code 301

[Matt Eaton]

Matt Eaton  added the comment:

Wanted to check in on this to see if there was any feedback by any community or 
core members?

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue33181] SimpleHTTPRequestHandler shouldn't redirect to directories with code 301

[Matt Eaton]

Matt Eaton  added the comment:

Adding some core team members to the nosy list to get their take on this as 
well.

--
nosy: +berker.peksag, eric.smith

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue33181] SimpleHTTPRequestHandler shouldn't redirect to directories with code 301

[Matt Eaton]

Matt Eaton  added the comment:

I agree with you in regards to the statement, "Apache's redirect can be turned 
off, whereas this can't."  That is why my first thought would be to try and 
control this response to the client a bit better by providing a variable 
max-age.

self.send_header("Cache-Control", "max-age=xxx")

Removing the condition completely would be good idea as well, but would be my 
second course of action due to this functionality being in the Python code base 
for awhile now.

if os.path.isdir(path):
for index in "index.html", "index.htm":
index = os.path.join(path, index)
if os.path.exists(index):
path = index
break


Those are my thoughts on the matter at least, possibly someone else in the 
community could weigh in as well?

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue33181] SimpleHTTPRequestHandler shouldn't redirect to directories with code 301

[Oliver Urs Lenz]

Oliver Urs Lenz  added the comment:

Yes, but Apache's redirect can be turned off, whereas this can't, so it seems 
unnecessarily limiting to force this on users. Note that most of the motivation 
given by Apache doesn't apply here: with my proposed simplification, both types 
of indices would still be served whether the path contains a trailing slash or 
not.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue33181] SimpleHTTPRequestHandler shouldn't redirect to directories with code 301

[Matt Eaton]

Matt Eaton  added the comment:

It looks like the 301 redirect is in place to emulate the behavior that Apache 
provides when it runs into a trailing slash.  This is observed when this 
condition is met:

parts = urllib.parse.urlsplit(self.path)
if not parts.path.endswith('/'):

Apache Directory Index Redirect:
http://httpd.apache.org/docs/current/mod/mod_dir.html#DirectoryIndexRedirect

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue33181] SimpleHTTPRequestHandler shouldn't redirect to directories with code 301

[Oliver Urs Lenz]

Oliver Urs Lenz  added the comment:

In fact, since we use os.path.join, we could remove that condition altogether:

if os.path.isdir(path):
for index in "index.html", "index.htm":
index = os.path.join(path, index)
if os.path.exists(index):
path = index
break

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue33181] SimpleHTTPRequestHandler shouldn't redirect to directories with code 301

[Oliver Urs Lenz]

Oliver Urs Lenz  added the comment:

That would definitely take the sting out of that permanent redirect. But I am 
still wondering why we redirect at all. Why not leave redirects to the user and 
do:

if os.path.isdir(path):
if not path.endswith('/'):
path = path + '/'
for index in "index.html", "index.htm":
index = os.path.join(path, index)
if os.path.exists(index):
path = index
break

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue33181] SimpleHTTPRequestHandler shouldn't redirect to directories with code 301

[Matt Eaton]

Matt Eaton  added the comment:

Oliver,

A possible option that would work for both the client side caching and the 
server would be to pass back a Cache-Control header with a max-age attached 
when the 301 is returned.

I am thinking something like this:

if os.path.isdir(path):
parts = urllib.parse.urlsplit(self.path)
if not parts.path.endswith('/'):
# redirect browser - doing basically what apache does
self.send_response(HTTPStatus.MOVED_PERMANENTLY)
new_parts = (parts[0], parts[1], parts[2] + '/',
 parts[3], parts[4])
new_url = urllib.parse.urlunsplit(new_parts)
self.send_header("Location", new_url)
self.send_header("Cache-Control", "max-age=600")
self.end_headers()
return None
for index in "index.html", "index.htm":
index = os.path.join(path, index)
if os.path.exists(index):
path = index
break


Possibly we could even provide some way for the max age to be variable.
Thoughts?

--
nosy: +agnosticdev

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue33181] SimpleHTTPRequestHandler shouldn't redirect to directories with code 301

[Oliver Urs Lenz]

New submission from Oliver Urs Lenz :

SimpleHTTPRequestHandler.send_head() has this bit:

if os.path.isdir(path):
parts = urllib.parse.urlsplit(self.path)
if not parts.path.endswith('/'):
# redirect browser - doing basically what apache does
self.send_response(HTTPStatus.MOVED_PERMANENTLY)

https://github.com/python/cpython/blob/521995205a2cb6b504fe0e39af22a81f785350a3/Lib/http/server.py#L676

I think there are two issues here:
1) why should the server return a redirect code here, and not (in the code that 
immediately follows) when it serves an index file?
2) code 301 (permanent redirect) is really unforgiving, browsers like Firefox 
and Chrome will permanently cache the redirect, making it essentially 
impossible to undo if you do not control the client, and not trivial even if 
you do. This will probably not change on the browser-side, general opinion 
seems to be that limited caching should either be specified in the response 
header or that a different redirect code should be sent back.
https://lists.w3.org/Archives/Public/ietf-http-wg/2017OctDec/thread.html#msg363

Therefore I would like to propose that preferably,
- no redirect code be sent back, or else that
- a different redirect code be sent back, or else that
- no-caching or a time limit be added to the header

(This may require that send_head check for index files instead)

--
components: Library (Lib)
messages: 314663
nosy: oulenz
priority: normal
severity: normal
status: open
title: SimpleHTTPRequestHandler shouldn't redirect to directories with code 301
versions: Python 3.6

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com