Mercurial > hg
annotate tests/test-newcgi.t @ 37048:fc5e261915b9
wireproto: require POST for all HTTPv2 requests
Wire protocol version 1 transfers argument data via request
headers by default. This has historically caused problems because
servers institute limits on the length of individual HTTP headers
as well as the total size of all request headers. Mercurial servers
can advertise the maximum length of an individual header. But
there's no guarantee any intermediate HTTP agents will accept
headers up to that length.
In the existing wire protocol, server operators typically also
key off the HTTP request method to implement authentication.
For example, GET requests translate to read-only requests and
can be allowed. But read-write commands must use POST and require
authentication. This has typically worked because the only wire
protocol commands that use POST modify the repo (e.g. the
"unbundle" command).
There is an experimental feature to enable clients to transmit
argument data via POST request bodies. This is technically a
better and more robust solution. But we can't enable it by default
because of servers assuming POST means write access.
In version 2 of the wire protocol, the permissions of a request
are encoded in the URL. And with it being a new protocol in a new
URL space, we're not constrained by backwards compatibility
requirements.
This commit adopts the technically superior mechanism of using
HTTP request bodies to send argument data by requiring POST for
all commands. Strictly speaking, it may be possible to send
request bodies on GET requests. But my experience is that not all
HTTP stacks support this. POST pretty much always works. Using POST
for read-only operations does sacrifice some RESTful design
purity. But this API cares about practicality, not about being
in Roy T. Fielding's REST ivory tower.
There's a chance we may relax this restriction in the future. But
for now, I want to see how far we can get with a POST only API.
Differential Revision: https://phab.mercurial-scm.org/D2837
author | Gregory Szorc <gregory.szorc@gmail.com> |
---|---|
date | Tue, 13 Mar 2018 11:57:43 -0700 |
parents | 8e6f4939a69a |
children | 5abc47d4ca6b |
rev | line source |
---|---|
22046
7a9cbb315d84
tests: replace exit 80 with #require
Matt Mackall <mpm@selenic.com>
parents:
15567
diff
changeset
|
1 #require no-msys # MSYS will translate web paths as if they were file paths |
15567
8b84d040d9f9
tests: introduce 'hghave msys' to skip tests that would fail because of msys
Mads Kiilerich <mads@kiilerich.com>
parents:
13269
diff
changeset
|
2 |
12470 | 3 This tests if CGI files from after d0db3462d568 but |
4 before d74fc8dec2b4 still work. | |
5577
e0173902c813
CGI compatibility fix for d74fc8dec2b4.
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
diff
changeset
|
5 |
12470 | 6 $ hg init test |
7 $ cat >hgweb.cgi <<HGWEB | |
32938
b6776b34e44e
tests: use $PYTHON in #! so we always use the right Python
Augie Fackler <augie@google.com>
parents:
22046
diff
changeset
|
8 > #!$PYTHON |
12470 | 9 > # |
10 > # An example CGI script to use hgweb, edit as necessary | |
11 > | |
12 > import cgitb | |
13 > cgitb.enable() | |
14 > | |
15 > from mercurial import demandimport; demandimport.enable() | |
16 > from mercurial.hgweb import hgweb | |
17 > from mercurial.hgweb import wsgicgi | |
18 > from mercurial.hgweb.request import wsgiapplication | |
19 > | |
20 > def make_web_app(): | |
12743
4c4aeaab2339
check-code: add 'no tab indent' check for unified tests
Adrian Buehlmann <adrian@cadifra.com>
parents:
12470
diff
changeset
|
21 > return hgweb("test", "Empty test repository") |
12470 | 22 > |
23 > wsgicgi.launch(wsgiapplication(make_web_app)) | |
24 > HGWEB | |
5577
e0173902c813
CGI compatibility fix for d74fc8dec2b4.
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
diff
changeset
|
25 |
12470 | 26 $ chmod 755 hgweb.cgi |
5577
e0173902c813
CGI compatibility fix for d74fc8dec2b4.
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
diff
changeset
|
27 |
12470 | 28 $ cat >hgweb.config <<HGWEBDIRCONF |
29 > [paths] | |
30 > test = test | |
31 > HGWEBDIRCONF | |
5577
e0173902c813
CGI compatibility fix for d74fc8dec2b4.
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
diff
changeset
|
32 |
12470 | 33 $ cat >hgwebdir.cgi <<HGWEBDIR |
32938
b6776b34e44e
tests: use $PYTHON in #! so we always use the right Python
Augie Fackler <augie@google.com>
parents:
22046
diff
changeset
|
34 > #!$PYTHON |
12470 | 35 > # |
36 > # An example CGI script to export multiple hgweb repos, edit as necessary | |
37 > | |
38 > import cgitb | |
39 > cgitb.enable() | |
40 > | |
41 > from mercurial import demandimport; demandimport.enable() | |
42 > from mercurial.hgweb import hgwebdir | |
43 > from mercurial.hgweb import wsgicgi | |
44 > from mercurial.hgweb.request import wsgiapplication | |
45 > | |
46 > def make_web_app(): | |
12743
4c4aeaab2339
check-code: add 'no tab indent' check for unified tests
Adrian Buehlmann <adrian@cadifra.com>
parents:
12470
diff
changeset
|
47 > return hgwebdir("hgweb.config") |
12470 | 48 > |
49 > wsgicgi.launch(wsgiapplication(make_web_app)) | |
50 > HGWEBDIR | |
5577
e0173902c813
CGI compatibility fix for d74fc8dec2b4.
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
diff
changeset
|
51 |
12470 | 52 $ chmod 755 hgwebdir.cgi |
5577
e0173902c813
CGI compatibility fix for d74fc8dec2b4.
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
diff
changeset
|
53 |
13269
aa3f726a2bdb
tests: remove duplication of the CGI environment variables
StevenGBrown
parents:
12743
diff
changeset
|
54 $ . "$TESTDIR/cgienv" |
33262
8e6f4939a69a
tests: replace yet more calls to `python` with $PYTHON
Augie Fackler <augie@google.com>
parents:
32938
diff
changeset
|
55 $ $PYTHON hgweb.cgi > page1 |
8e6f4939a69a
tests: replace yet more calls to `python` with $PYTHON
Augie Fackler <augie@google.com>
parents:
32938
diff
changeset
|
56 $ $PYTHON hgwebdir.cgi > page2 |
12470 | 57 |
58 $ PATH_INFO="/test/" | |
59 $ PATH_TRANSLATED="/var/something/test.cgi" | |
60 $ REQUEST_URI="/test/test/" | |
61 $ SCRIPT_URI="http://hg.omnifarious.org/test/test/" | |
62 $ SCRIPT_URL="/test/test/" | |
33262
8e6f4939a69a
tests: replace yet more calls to `python` with $PYTHON
Augie Fackler <augie@google.com>
parents:
32938
diff
changeset
|
63 $ $PYTHON hgwebdir.cgi > page3 |
12470 | 64 |
65 $ grep -i error page1 page2 page3 | |
66 [1] |