#36653: FORCE_SCRIPT_NAME is not respected for static URLs
-------------------------------------+-------------------------------------
Reporter: Brian Helba | Owner: (none)
Type: Bug | Status: new
Component: contrib.staticfiles | Version: 5.2
Severity: Normal | Resolution:
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Brian Helba):
In terms of policies for a solution, although `settings.FORCE_SCRIPT_NAME`
might practically be constant over Django's lifecycle, it's completely
allowed by WSGI for the value of the `SCRIPT_NAME` environment variable to
change on each request (and there's code in step 13 to support this). So,
I think it follows that that `settings.STATIC_URL` should also be allowed
to change on each new HTTP request. I'd encourage this path.
If we require that `settings.STATIC_URL` shouldn't change, it allows for
some simpler fixes that only require `STATIC_URL` to eventually respect
`FORCE_SCRIPT_NAME` and maybe the first-presented value of a `SCRIPT_NAME`
environment variable. I think this would lead to confusing behavior for
anyone using `SCRIPT_NAME`.
Alternatively, we could change
[https://docs.djangoproject.com/en/5.2/ref/settings/#static-url the
documentation] for `STATIC_URL` to state that it doesn't respect
`SCRIPT_NAME`, but that would be a larger policy change (not a simple
bugfix) and it'd lead to a slipperly slope of just dropping all support
for `SCRIPT_NAME` / `FORCE_SCRIPT_NAME`, etc. (which is out of scope for
this issue). I think this change is too ambitious and would remove useful
functionality for serving Django within subpaths behind reverse proxies,
so I don't support it.
----
I see two reasonable changes:
1. Change the behavior (in step 6-9) of `settings.STATIC_URL`, so it's not
permanently cached. Each access of `settings.STATIC_URL` would recomputed
the value, using `LazySettings._add_script_prefix`.
2. Change `set_script_prefix` to reach into `settings` and invalidate the
cache of `STATIC_URL`, causing step 13 to have its full intended effect.
This is technically more efficient than having no cache of `STATIC_URL`,
but introduces additional circularity in the relationship between all
these methods and further breaks the abstraction of `LazySettings` (as
`LazySettings` caches itself internally, but has its cache invalidated
externally).
--
Ticket URL: <https://code.djangoproject.com/ticket/36653#comment:4>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/django-updates/01070199cae7822e-39c1f920-c95b-4fa8-bf24-d2bfd98741ba-000000%40eu-central-1.amazonses.com.
