Skip to content

[HttpFoundation][HttpKernel] Improving the request/response format autodetection #32344

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 3, 2019

Conversation

yceruto
Copy link
Member

@yceruto yceruto commented Jul 3, 2019

Q A
Branch? 4.4
Bug fix? no
New feature? yes
BC breaks? no
Deprecations? no
Tests pass? yes
Fixed tickets -
License MIT
Doc PR -

Mainly for API-based apps, currently the response header Content-Type (if not provided) is guessed based on the request format (_format attribute), falling back to html by default.

Especially for the new error renderer system, where any kind of error can occur and it becomes an http response, this PR improves this guesser mechanism by taking into account also the Content-type of the request.

Example:

$ curl -X POST -H 'Content-Type: application/json' -i 'https://127.0.0.1:8000/login'

before:

HTTP/2 500 
cache-control: no-cache, private
content-type: text/html; charset=UTF-8 # <- inaccurate
...

{"title":"Internal Server Error","status":500,"detail":"Invalid credentials!"}

Most of the 3rd-party bundles that I know (api-platform/core, FOSRestBundle) need a dedicated listener to achieve it right.

after:

HTTP/2 500 
cache-control: no-cache, private
content-type: application/json
...

{"title":"Internal Server Error","status":500,"detail":"Invalid credentials!"}

Of course, this applies to all kind of responses, as long as the Content-Type is not explicitly provided. So, as a last chance, the Accept heading of the request is also taken into account to detect the preferred format:

$ curl -H 'Accept: application/json' -i 'https://127.0.0.1:8000/userinfo'
HTTP/2 404
cache-control: no-cache, private
content-type: application/json
...

{"title":"Not Found","status":404,"detail":"No route found for \"GET \/userinfo\""}

They could be other places in the code where this new method could also be useful, please advise :)

WDYT?

@OskarStark
Copy link
Contributor

cc @dunglas

Copy link
Member

@fabpot fabpot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@yceruto
Copy link
Member Author

yceruto commented Jul 3, 2019

Tests added.

Status: Needs Review

@yceruto yceruto force-pushed the preferred_request_format branch from d9b77c4 to 1952928 Compare July 3, 2019 16:47
@fabpot
Copy link
Member

fabpot commented Jul 3, 2019

Thank you @yceruto.

@fabpot fabpot merged commit 1952928 into symfony:4.4 Jul 3, 2019
fabpot added a commit that referenced this pull request Jul 3, 2019
…ponse format autodetection (yceruto)

This PR was merged into the 4.4 branch.

Discussion
----------

[HttpFoundation][HttpKernel] Improving the request/response format autodetection

| Q             | A
| ------------- | ---
| Branch?       | 4.4
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Mainly for API-based apps, currently the response header `Content-Type` (if no provided) is guessed based on the request format (`_format` attribute), falling back to `html` by default.

Especially for the new error renderer system, where any kind of error can occur and it becomes an http response, this PR improves this guesser mechanism by taking into account also the `Content-type` of the request.

Example:
```bash
$ curl -X POST -H 'Content-Type: application/json' -i 'https://127.0.0.1:8000/login'
```
**before:**
```bash
HTTP/2 500
cache-control: no-cache, private
content-type: text/html; charset=UTF-8 # <- inaccurate
...

{"title":"Internal Server Error","status":500,"detail":"Invalid credentials!"}
```
Most of the 3rd-party bundles that I know (`api-platform/core`, `FOSRestBundle`) need a dedicated listener to achieve it right.

**after:**
```bash
HTTP/2 500
cache-control: no-cache, private
content-type: application/json
...

{"title":"Internal Server Error","status":500,"detail":"Invalid credentials!"}
```
Of course, this applies to all kind of responses, as long as the `Content-Type` is not explicitly provided. So, as a last chance, the `Accept` heading of the request is also taken into account to detect the preferred format:
```bash
$ curl -H 'Accept: application/json' -i 'https://127.0.0.1:8000/userinfo'
HTTP/2 404
cache-control: no-cache, private
content-type: application/json
...

{"title":"Not Found","status":404,"detail":"No route found for \"GET \/userinfo\""}
```
They could be other places in the code where this new method could also be useful, please advise :)

WDYT?

Commits
-------

1952928 Improving the request/response format autodetection
@yceruto yceruto deleted the preferred_request_format branch July 3, 2019 17:10
fabpot added a commit that referenced this pull request Jul 4, 2019
…tPreferredFormat() (dunglas)

This PR was squashed before being merged into the 4.4 branch (closes #32348).

Discussion
----------

[HttpFoundation] Accept must take the lead for Request::getPreferredFormat()

| Q             | A
| ------------- | ---
| Branch?       | 4.4
| Bug fix?      | yes
| New feature?  | no <!-- please update src/**/CHANGELOG.md files -->
| BC breaks?    | no     <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass?   | yes    <!-- please add some, will be required by reviewers -->
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

Follow up PR to #32344: if both `Accept` and `Content-Type` are defined, `Accept` must take the lead because it explicitly tells what format the client expect as a response.

Before:

```
$ curl -H 'Accept: application/json' -H 'Content-Type: text/xml' -i 'https://127.0.0.1:8000/userinfo'

[snip]
content-type: text/xml
```

After:

```
$ curl -H 'Accept: application/json' -H 'Content-Type: text/xml' -i 'https://127.0.0.1:8000/userinfo'

[snip]
content-type: application/json
```

Actually, I'm not sure that inferring the content type of the response using the `Content-Type` provided for the request body is a good idea. The HTTP RFC explicitly states that `Accept` must be used to hint a preferred response format (`Content-Type` on the request indicates the type of associated its the body). I would be in favor of being more conservative: use `Accept` if provided (a best practice anyway), and fallback to the default value (HTML by default) otherwise. WDYT?

Commits
-------

60d997d [HttpFoundation] Accept must take the lead for Request::getPreferredFormat()
@nicolas-grekas nicolas-grekas modified the milestones: next, 4.4 Oct 27, 2019
@fabpot fabpot mentioned this pull request Nov 12, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants