Re: URI handling for Location

On Wed, 08 Apr 2009 13:01:12 +0200, Mark Nottingham <mnot@mnot.net> wrote:
> Regarding relative URIs -- changing their syntax to allow relative URIs  
> would be a breaking change for existing implementations, so at first  
> blush it's out of scope for HTTPbis (and indeed anything but HTTP/2.0).  
> What's the nature of the problems you're seeing with it being an  
> absolute URI?

In

   http://lists.w3.org/Archives/Public/ietf-http-wg/2009JanMar/0276.html

I pointed to

   http://krijnhoetmer.nl/irc-logs/whatwg/20090323#l-152

which says among other things that e.g.

   http://www.usafa.af.mil/
   http://www.flightsimulator.nl/

return Location with a non-absolute URI and are expected to work fine. In  
addition those Location header values also do not match the URI syntax  
because they contain a space and backslash respectively. Still, they work  
fine in Web browsers and curl/wget etc.

So I'm not quite sure what you consider "breaking" here, but it seems to  
me that the current specification requires a breaking change of existing  
implementations.


> Regarding the range of content in the Location header itself -- hm. The  
> majority of Location headers are produced by HTTP implementations  
> themselves (e.g., from /foo to /foo/), and if they're broken, I don't  
> think there's going to be a lot of sympathy for working around these  
> issues.

I'm not asking for sympathy.


> OTOH some Location headers are going to be generated by scripts, etc.  
> However, the variation in these would likely be wide, unless UAs (not  
> just browsers) already implement a predictable, well-known set of  
> canonicalisations.  Do they -- for Location?

Yes. See e.g. the URL parsing algorithm as documented by e.g. HTML5 and  
the Web Addreses draft from DanC.


> Also, how widespread is this problem; are we talking about a few sites,  
> or most of the Web?

Widespread enough that it was relatively easy to find the sites above. I'd  
expect the problem is quite widespread since relative URIs and  
syntactically invalid URIs work fine and generating them using ASP, PHP,  
etc. is trivial.


> I'm happy to open an issue on this second aspect, but we need more  
> information than a pointer to an IRC discussion that mentions two URIs  
> that produce bad Location headers. Can you give us more context, please?

What exactly do you need, more examples?


-- 
Anne van Kesteren
http://annevankesteren.nl/

Received on Wednesday, 8 April 2009 11:35:37 UTC