[Web-SIG] Request for Comments on upcoming WSGI Changes

[And Clover]

Ian Bicking wrote:

> OK, another proposal entirely: we kill SCRIPT_NAME and PATH_INFO, and
> introduce two equivalent variables that hold the NOT url-decoded values.

Yes, that was my preferred option, it makes all the worries about 
encodings quite moot: everything is effectively ASCII; they'll work fine 
both as byte native strings in Python 2 and unicode native strings in 
Python 3.

Although I would prefer not to *kill* SCRIPT_NAME/PATH_INFO, but to add 
to them, when the raw name and info are available. A server or 
middleware should *not* attempt to recreate these values from the 
processed SCRIPT_NAME/PATH_INFO values(*).

So when you see (eg.) 'wsgi.script_name_raw' and 'wsgi.path_info_raw' in 
your environ, you can be 100% sure they're correct and you can go ahead 
and use IRIs (and %2F if you must). If you don't see them, you have to 
continue to rely on the SCRIPT_NAME/PATH_INFO, so either fall back to 
ASCII-only URLs or take your chances with the charset lottery that is 
the current status quo.

If, like most applications, you don't care about non-ASCII URLs, you can 
ignore the whole issue and continue using SCRIPT_NAME/PATH_INFO.

(*: although arguably a middleware that recreates them from Apache's 
REQUEST_URI is partially possible.)

> i.e., ideally decoding should happen on path segments, each segment
> separated by a real /.

That is correct. Apache still disables paths with '%2F' in as a security 
precaution, but that's easily turned off.

> If we do that, then the only really tricky thing left is HTTP_COOKIE

I don't think that's particularly tricky is it? In as much as non-ASCII 
characters in the Cookie header are already completely broken 
everywhere, so everyone has to use ad-hoc encoding methods.

As Cookie is an actual HTTP header the encoding should presumably be 
ISO-8859-1, but I don't think it actually works anywhere.

-- 
And Clover
mailto:and at doxdesk.com
http://www.doxdesk.com/


-- 
And Clover
mailto:and at doxdesk.com
http://www.doxdesk.com/