tornadoweb
relative URIs in Location header
The old specification of HTTP defined the values of a Location header to be absolute URI's.
https://datatracker.ietf.org/doc/html/rfc2616#section-14.30
Location = "Location" ":" absoluteURI
Nowadays, because there are so many broken implementations, relative URI's seem to be allowed as well:
https://datatracker.ietf.org/doc/html/rfc7231#section-7.1.2
Location = URI-reference
Sometimes this leads to errors.
Wouldn't it be better if tornado completes the URI or at least give a chance to do it?
For example I expected self.reverse_url() to return an absolute URI or at least that self.redirect() does that for me.
useful would be to add:
def reverse_absolute_url(self, name, *args):
return self.request.protocol + "://" + self.request.host + self.reverse_url(name, *args)
Wouldn't it be better if tornado completes the URI or at least give a chance to do it?
How would it be better?
Personally I haven't run into problems like this with relative URLs, but I have run into issues where attempts to produce an absolute URL fails because the backend server is unaware of how things look from the other side of a reverse proxy. I tend to use relative urls as much as possible.
OK, but what do you think about giving users the possibility to easier use absolute URI's - e.g. via above example or redirect(..., absolute=True)?
In every project I do I first make sure that the base-URI is equal to the gateways the tornado app is behind (or properly set up ProxyPassReverse, etc.).
I think that it makes sense for methods like reverse_url that produce urls to take an absolute argument (we have some related functionality although we're not consistent in terminology. static_url has an include_host argument and request objects have a full_url() method. I don't like either of these names and would use absolute if we could start over, but given the precedent maybe the argument to reverse_url should also be include_host). And we could add a method to convert relative urls to absolute. But I don't think methods like redirect that accept urls should have an argument to transform the input like this.
Rather than choosing a naming convention based on legacy code, what about renaming include_host and emit a deprecation warning when that gets used?
