Support the HEAD method properly

• Key: MODPYTHON-71
• Type: Bug
• Status: Closed
• Resolution: Invalid
• Priority: Minor
• Assignee: Unassigned
• Reporter: Nicolas Lehuen
• Component/s: core
• Affects Version/s: 2.7.10, 3.1.3, 3.1.4, 3.2.7

Description

RFC 2616, 9.4 HEAD :
8<---8<---8<---8<---8<---
 The HEAD method is identical to GET except that the server MUST NOT return
 a message-body in the response. The metainformation contained in the HTTP
 headers in response to a HEAD request SHOULD be identical to the
 information sent in response to a GET request.
8<---8<---8<---8<---8<---

Could we make sure that nothing is returned to the client ? Perhaps by making sure that req.write does nothing whenever the request method is HEAD ?

Comments

[Jim Gallacher]

Apache may already be doing the right thing for us. Using netcat as the client I ran the some tests using the the following as the handler:

/mp/mptest.py
from mod_python import Session
def handler(req):
    req.content_type = 'text/plain'
    sess = Session.Session(req)
    sess.do_cleanup()
    try:
        sess['hits'] += 1
    except:
        sess['hits'] = 0

    req.write('mptest.py\n')
    req.write('hits: %d\n' % (sess['hits']))
    req.write('Blah blah blah blah blah\n')
    sess.save()
    return apache.OK

Note that the host name has been obscured in these tests.

Test 1.
=======
Request
-------
GET /mp/mptest.py HTTP/1.1
Host: example.com
Connection: close

Response
--------
HTTP/1.1 200 OK
Date: Wed, 10 Aug 2005 18:58:49 GMT
Server: Apache/2.0.54 (Debian GNU/Linux) mod_python/3.2.0-dev-20050809 Python/2.3.5
Cache-Control: no-cache="set-cookie"
Set-Cookie: pysid=0a81c130420c736c10e196e48603cb96; path=/mp
Connection: close
Transfer-Encoding: chunked
Content-Type: text/plain

a
mptest.py

8
hits: 0

19
Blah blah blah blah blah

0

Comments
--------
Netcat just dumps out whatever it receives. The stray a, 8, 19 and 0 are part of the chunked transfer scheme and can be ignored.


Test 2.
=======
Request
-------
HEAD /mp/mptest.py HTTP/1.1
Host: example.com
Connection: close

Response
--------
HTTP/1.1 200 OK
Date: Wed, 10 Aug 2005 18:59:04 GMT
Server: Apache/2.0.54 (Debian GNU/Linux) mod_python/3.2.0-dev-20050809 Python/2.3.5
Cache-Control: no-cache="set-cookie"
Set-Cookie: pysid=2cc812f1426e5580aaf86904ee41fa3d; path=/mp
Connection: close
Content-Type: text/plain


Comments
--------
Looks like mod_python is doing the right thing. The body of the request is not being sent to the client.

As long as any publisher methods we create stuff HEAD into the allowed methods we should be ok wrt the RFC. I'd say that the change Nicolas made in publisher.py is correct, although

        if req.method!='HEAD':
            req.write(result)

may not be required if the apache ap_rwrite() call is taking care of it. I'll dig into the apache code later tonight to confirm this.

[Graham Dumpleton]

Further checking did indeed find that a handler should not truncate output for HEAD. Doing so can actually interfere with output filters that do things such as calculate content length, such as is done by the output filter called CONTENT_LENGTH.