Location: header and CGI spec

[Marc Slemko <ma...@znep.com>]

If a CGI sends a:

	Location: /foo/

header, the CGI spec says:

     * Location
       This is used to specify to the server that you are returning a
       reference to a document rather than an actual document.
       If the argument to this is a URL, the server will issue a redirect
       to the client.
       If the argument to this is a virtual path, the server will
       retrieve the document specified as if the client had requested
       that document originally. ? directives will work in here, but #
       directives must be redirected back to the client.

That means the relative path should be fine, and Apache should
handle it.  Most of the time, it does that with an internal
subrequest.

However, if a CGI sends:

	Status: 302 goober
	Location: /foo/

then Apache returns a redirect with /foo/.  That is invalid according
to the spec, no?  Apache needs to either qualify it or handle it
internally, no?

Re: Location: header and CGI specy

[Marc Slemko <ma...@worldgate.com>]

That is almost what I was thinking, but am not sure I quite buy that.
Yes, it is probably the correct answer but it doesn't entirely strike me
as right.

The status header isn't defined as changing the behavior at all.  In
theory, a:

     Status: 301 Moved Permanently

should result in the exact same output as a script without one.  However,
if you have a 200 or something then it should obviously not add its own
body.  Yes, the way it is done is probably best overall, but...

It is all, of course, due to the CGI standard or lack thereof.

On Mon, 18 Aug 1997, Alexei Kosut wrote:

> On Sun, 17 Aug 1997, Dean Gaudet wrote:
> 
> > Looks like a bug to me.
> 
> I suspect not. Apache only deals with the Location: header if there is no
> Status: header. It always has, as have all the other CGI implementations
> that existed prior to Apache (NCSA and CERN - I don't know what more
> recent servers do).
> 
> See, if you get headers as Marc shows, "Apache" does not return a
> redirect. The CGI returns a redirect. In other words, Apache does not
> parse Location, it does not provide a body, the CGI has to do all
> that. And Apache doesn't know that "/foo/" isn't a valid response for
> Location in whatever context the CGI is speaking to the browser.
> 
> Without Status:, Apache handles the redirect for the CGI, expanding it
> (or doing an internal redirect), providing a body, etc... But it
> shouldn't do that if the CGI has told Apache it can take care of itself.
> 
> > On Sun, 17 Aug 1997, Marc Slemko wrote:
> > 
> > > 	Status: 302 goober
> > > 	Location: /foo/
> > > 
> > > then Apache returns a redirect with /foo/.  That is invalid according
> > > to the spec, no?  Apache needs to either qualify it or handle it
> > > internally, no?
> > 
> > 
> 
> -- Alexei Kosut <ak...@organic.com>
> 

Re: Location: header and CGI specy

[Alexei Kosut <ak...@organic.com>]

On Mon, 18 Aug 1997, Dean Gaudet wrote:

> I would buy this if "Status" was something we added and wasn't defined in
> the spec... but it is defined in the spec and it doesn't say that we
> shouldn't do the Location processing if we get a Status.

Um... what spec? There certainly was none until well after Apache's
predecessor, the NCSA httpd, had CGI implemented. AFAIK, the only sort of
"spec" is David Robinson's ill-fated internet draft, which was supposed
to describe the codify the behavior of existing specifications.

Then there's NCSA's documentation, which isn't really a specification,
but more of a how-to on writing CGI scripts.

In other words, what I'm trying to say is this: There is no CGI
spec. Therefore, it can't define anything. Therefore, it can't say we
shouldn't do anything. Therefore, we should continue to do what we have
always done, which is what NCSA always did, which is what our users
expect, because they've been doing it for years.

-- Alexei Kosut <ak...@organic.com>

Re: Location: header and CGI specy

[Dean Gaudet <dg...@arctic.org>]

I would buy this if "Status" was something we added and wasn't defined in
the spec... but it is defined in the spec and it doesn't say that we
shouldn't do the Location processing if we get a Status.

Dean

On Mon, 18 Aug 1997, Alexei Kosut wrote:

> On Sun, 17 Aug 1997, Dean Gaudet wrote:
> 
> > Looks like a bug to me.
> 
> I suspect not. Apache only deals with the Location: header if there is no
> Status: header. It always has, as have all the other CGI implementations
> that existed prior to Apache (NCSA and CERN - I don't know what more
> recent servers do).
> 
> See, if you get headers as Marc shows, "Apache" does not return a
> redirect. The CGI returns a redirect. In other words, Apache does not
> parse Location, it does not provide a body, the CGI has to do all
> that. And Apache doesn't know that "/foo/" isn't a valid response for
> Location in whatever context the CGI is speaking to the browser.
> 
> Without Status:, Apache handles the redirect for the CGI, expanding it
> (or doing an internal redirect), providing a body, etc... But it
> shouldn't do that if the CGI has told Apache it can take care of itself.
> 
> > On Sun, 17 Aug 1997, Marc Slemko wrote:
> > 
> > > 	Status: 302 goober
> > > 	Location: /foo/
> > > 
> > > then Apache returns a redirect with /foo/.  That is invalid according
> > > to the spec, no?  Apache needs to either qualify it or handle it
> > > internally, no?
> > 
> > 
> 
> -- Alexei Kosut <ak...@organic.com>
> 
> 

Re: Location: header and CGI specy

[Alexei Kosut <ak...@organic.com>]

On Sun, 17 Aug 1997, Dean Gaudet wrote:

> Looks like a bug to me.

I suspect not. Apache only deals with the Location: header if there is no
Status: header. It always has, as have all the other CGI implementations
that existed prior to Apache (NCSA and CERN - I don't know what more
recent servers do).

See, if you get headers as Marc shows, "Apache" does not return a
redirect. The CGI returns a redirect. In other words, Apache does not
parse Location, it does not provide a body, the CGI has to do all
that. And Apache doesn't know that "/foo/" isn't a valid response for
Location in whatever context the CGI is speaking to the browser.

Without Status:, Apache handles the redirect for the CGI, expanding it
(or doing an internal redirect), providing a body, etc... But it
shouldn't do that if the CGI has told Apache it can take care of itself.

> On Sun, 17 Aug 1997, Marc Slemko wrote:
> 
> > 	Status: 302 goober
> > 	Location: /foo/
> > 
> > then Apache returns a redirect with /foo/.  That is invalid according
> > to the spec, no?  Apache needs to either qualify it or handle it
> > internally, no?
> 
> 

-- Alexei Kosut <ak...@organic.com>

Re: Location: header and CGI spec

[Dean Gaudet <dg...@arctic.org>]

Looks like a bug to me.

Dean

On Sun, 17 Aug 1997, Marc Slemko wrote:

> 	Status: 302 goober
> 	Location: /foo/
> 
> then Apache returns a redirect with /foo/.  That is invalid according
> to the spec, no?  Apache needs to either qualify it or handle it
> internally, no?