[Python-Dev] urllib.py and 303 redirect

[Guido van Rossum]

> > Whatever we do should probably also be backported to Python 2.2.1.
> 
> Should it?  IMO, not unless someone stands forward with a clear case
> that the current behavior for 302 is buggy.  If the current behavior
> is simply ambiguous and works well enough in many situations, I
> think that changing semantics would be counter to the intention for
> bugfix releases.

The recommendation in the HTTP/1.1 standard is unclear IMO.  It says:

| 10.3.3 302 Found
| 
| The requested resource resides temporarily under a different
| URI. Since the redirection might be altered on occasion, the client
| SHOULD continue to use the Request-URI for future requests. This
| response is only cacheable if indicated by a Cache-Control or
| Expires header field.
| 
| The temporary URI SHOULD be given by the Location field in the
| response. Unless the request method was HEAD, the entity of the
| response SHOULD contain a short hypertext note with a hyperlink to
| the new URI(s).

OK so far.

| If the 302 status code is received in response to a request other
| than GET or HEAD, the user agent MUST NOT automatically redirect the
| request unless it can be confirmed by the user, since this might
| change the conditions under which the request was issued.

I *think* this says that the current urllib behavior (to reissue a
POST request to the redirected URL) should *not* be done, since there
is no user confirmation.

|       Note: RFC 1945 and RFC 2068 specify that the client is not
|       allowed to change the method on the redirected request.
|       However, most existing user agent implementations treat 302 as
|       if it were a 303 response, performing a GET on the Location
|       field-value regardless of the original request method. The
|       status codes 303 and 307 have been added for servers that wish
|       to make unambiguously clear which kind of reaction is expected
|       of the client.

This is ambiguous but suggests that changing PUT to GET is what most
servers expect by now.

> No objection here to adding 303 and 307 handlers, though.

Could I shame you into submitting a patch? :-)

--Guido van Rossum (home page: http://www.python.org/~guido/)