No longer allow lowercase HTTP methods #170
Conversation
|
Closes #154 |
waitress/parser.py
Outdated
| command = m.group(1).upper() | ||
| method = m.group(1) | ||
|
|
||
| # the |
There was a problem hiding this comment.
This comment could use a couple more iterations and design meetings.
There was a problem hiding this comment.
Seems I forgot to commit after adding the comment. Done now.
waitress/parser.py
Outdated
|
|
||
| # the | ||
| if method != method.upper(): | ||
| raise ParsingError('Malformed HTTP method "%s"' % tostr(method)) |
There was a problem hiding this comment.
Is there a reason to force it to be upper specifically instead of just passing it through untouched?
There was a problem hiding this comment.
Yeah, nginx and other servers drop the incoming request on the floor. This caused me a lot of headache and debugging issues when I was testing with waitress locally and using nginx in production.
All currently defined HTTP methods are uppercase, I don't think it is a bad idea to enforce that.
digitalresistor
force-pushed
the
bugfix/uppercase_verb
branch
from
70e916f to
e3ad2a3
Compare
Yes, and browsers unconditionally turn that into a |
…1.1.0 1.1.0 (2017-10-10) ------------------ Features ~~~~~~~~ - Waitress now has a __main__ and thus may be called with ``python -mwaitress`` Bugfixes ~~~~~~~~ - Waitress no longer allows lowercase HTTP verbs. This change was made to fall in line with most HTTP servers. See Pylons/waitress#170 - When receiving non-ascii bytes in the request URL, waitress will no longer (NEWS truncated at 15 lines)
RFC 7231 specifies that methods are case sensitive, and by convention are all uppercase: https://tools.ietf.org/html/rfc7231#section-4.1
https://tools.ietf.org/html/rfc7231#section-8.1 specifies that there is a registry for all of the HTTP methods that exist, which is available here: https://www.iana.org/assignments/http-methods/http-methods.xhtml (in other news, there are a lot more there than I was aware of :P)
All of them are uppercase.
I recently ran into an interesting issue, I was using the new
fetch()function in JavaScript and it allowed me to send apostrequest instead of aPOSTrequest. nginx dropped the request on the floor, but waitress locally was allowing it by just calling.upper()on the method.This change brings things more in line with all other HTTP servers, and disallows anything put an uppercase HTTP method thereby hopefully making it harder to have differences between prod and devel...