Don't accidently create relative links#1538
Conversation
append_slash_redirect should not change absolute links to relative ones. That breaks serving applications via nginx. e.g. PATH_INFO="/help/test" -> the Location would be "help/test/" and this is translated correctly by nginx to: https://example.com/help/help/test
|
Please add tests and a changelog. |
|
I'm not super clear what issue you're fixing based on your description. Fairly sure this is intentional, SCRIPT_NAME and PATH_INFO will be combined later in the response and will always create an absolute path. |
|
@davidism at least in my case this doesn't work. see here the environ: So far I see SCRIPT_NAME is not anywhere used within the redirect function, that's why I'm wondering who is responsible to create absolute links? My setup is nginx <-> uwsgi <-> flask/werkzeug |
|
werkzeug/src/werkzeug/wrappers/base_response.py Lines 595 to 609 in 0853c2a |
okay than it is wekrzeug, who creates the absolute url wrongly ;D See line 607: IMO current_url is wrong to use there, instead SCRIPT_NAME needs to been taking into account. |
|
The current behavior is correct. In WSGI, paths are typically relative to the script_root, which is defined by the base_url in the test client. |
|
@davidism: can you point me to some documentation for this? I still think absolute links needs to handled different than relative ones. As in the case I need this fix 'SCRIPT_NAME' is '/' and 'PATH_INFO' is '/help/foo'. And I need to create a link to '/nonhelp'. With the current implementation I never can create links to '/nonhelp', as I always end up in '/help/nonhelp'. But '/nonhelp is still in namespace of SCRIPT_NAME and that means it is a valid PATH_INFO to request for. |
|
I cannot agree that the current code works correctly. If the URL passed to append_slash_redirect() begins with a leading slash it is an absolute URL and the slash should not be removed. The URL should remain absolute or relative after the function completes. I believe this is a coding error, strip() has been used instead of rstrip(). The only reason that strip() is called at all is to ensure that the returned URL does not end up with two trailing slashes. So, to my mind, line 542 currently uses strip('/') but should use rstrip:
|
|
This is an issue with your use of the function and the wsgi environ, not with the function itself. There's another discussion that goes into more detail, but I'm on my phone and can't find it right now. Suffice to say, I've looked into this in depth and concluded there is not an issue. |
|
Addressed in #2338 |
append_slash_redirect should not change absolute links to relative ones.
That breaks serving applications via nginx.
e.g.
PATH_INFO="/help/test" -> the Location would be "help/test/" and this is translated correctly by nginx to:
https://example.com/help/help/test