Support disabling default Server and Date headers #818

stiiin · 2020-10-14T18:46:57Z

As described in the individual commit messages, this pull request adds configuration flags to control the default Server and Date headers. With these flags, the Server header can be entirely removed rather than overwritten, and the Date header can be suppressed in (the extremely rare) case that HTTP/1.1 requires an origin server to do so.

Fixes #688

euri10 · 2021-06-07T12:18:50Z

for reference
https://gitter.im/encode/community?at=5f8726a399e1ab4dd1fc7b64

euri10

Hi @stiiin sorry for getting back this late,
could you please if you still fancy doing it rebase this PR and adapt your tests to the new "layout" we setup for tests, reading current tests this should be fairly easy, if you dont have time let me know I'll pursue this PR.

euri10 · 2021-06-07T12:23:39Z

also if you can find again the relevant part of the RFC that would be awesome to keep it written here for future reference, thanks !

stiiin · 2021-06-07T18:39:18Z

Hi @euri10! I rebased my changes, but without running tests. Let's see if the workflow likes it.

also if you can find again the relevant part of the RFC that would be awesome to keep it written here for future reference, thanks !

I already mentioned a section of the RFC in the commit message for the Date header change. Is that what you were looking for, or was it something else?

euri10 · 2021-06-08T07:41:59Z

the CI fails, you can use ./scripts/lint

you also can use ./scripts/check and ./scripts/test locally also, it would be preferable as now Github forces me to approve workflow runs for 1st time contributor which is a pain in the **** :)

and thanks for the rfc, ~~but I cant find the link to the server one~~

date: https://datatracker.ietf.org/doc/html/rfc7231#section-7.1.1.2
server: https://datatracker.ietf.org/doc/html/rfc7231#section-7.4.2

tests/test_default_headers.py

stiiin · 2021-06-08T15:15:57Z

Sorry for the failed run, I should've just looked around a bit more to find the linter and test run script.

After fixing the linter issues, it seems I messed up the rebase in a way that removed the behaviour for the Date header, so I re-implemented that. Please review those changes, maybe the naming or the style could be better.

I've changed the commit message about the Server option so that it refers to 7.4.2 from the same RFC, where the wording implies that the Server header is optional.

docs/deployment.md

euri10

approved with the last naming agreed on ! I'll do the merge once done
thanks a lot for this @stiiin !

uvicorn/main.py

stiiin · 2021-06-10T17:16:11Z

You're right, I should've acted on my other gut feeling ;)

If you don't mind, I'll amend my changes rather than using Github's commit feature. At least I know what's going to happen if I do it through git's CLI.

Section 7.4.2 of RFC 7231 states that "an origin server MAY generate a Server field in its responses." The "MAY" means that sending this header is entirely optional. While the implementation of #321 allowed applications to override the Server header, there was no way to disable the Server header altogether. By default, uvicorn adds a Server header to each response that doesn't have one through other means. This change adds the server_header flag to Config, as well as the commandline option --no-server-header, through which this behaviour can be disabled.

When an origin server does not have a sufficiently reliable clock, section 7.1.1.2 of RFC 7231 stipulates that it "MUST NOT" send a Date header field. By default, uvicorn adds a Date header to each response. This change adds the date_header flag to Config, as well as the commandline option --no-date-header, through which this behaviour can be disabled.

euri10 · 2021-06-11T06:24:43Z

thanks a lot @stiiin !

Kludex

I forgot to press enter on the review. 😅

I'm going to create a small PR later.

Kludex · 2021-06-10T17:36:52Z

tests/test_default_headers.py

@@ -36,6 +36,20 @@ async def test_override_server_header():
            )


+@pytest.mark.asyncio
+async def test_disable_default_server_header():


Suggested change

async def test_disable_default_server_header():

async def test_disable_server_header():

Kludex · 2021-06-10T17:37:27Z

tests/test_default_headers.py

+
+
+@pytest.mark.asyncio
+async def test_disable_default_date_header():


Suggested change

async def test_disable_default_date_header():

async def test_disable_date_header():

Kludex · 2021-06-10T17:37:44Z

uvicorn/main.py

+    "--server-header/--no-server-header",
+    is_flag=True,
+    default=True,
+    help="Enable/Disable default Server header.",


Suggested change

help="Enable/Disable default Server header.",

help="Enable/Disable server header.",

I think the distinction in the help text would still be somewhat helpful. You can always issue a Server header from the application code, right?

Fair point. 😗 👍

Kludex · 2021-06-10T17:38:10Z

uvicorn/main.py

+    "--date-header/--no-date-header",
+    is_flag=True,
+    default=True,
+    help="Enable/Disable default Date header.",


Suggested change

help="Enable/Disable default Date header.",

help="Enable/Disable date header.",

* Support disabling default Server header (#688) Section 7.4.2 of RFC 7231 states that "an origin server MAY generate a Server field in its responses." The "MAY" means that sending this header is entirely optional. While the implementation of #321 allowed applications to override the Server header, there was no way to disable the Server header altogether. By default, uvicorn adds a Server header to each response that doesn't have one through other means. This change adds the server_header flag to Config, as well as the commandline option --no-server-header, through which this behaviour can be disabled. * Support disabling default Date header When an origin server does not have a sufficiently reliable clock, section 7.1.1.2 of RFC 7231 stipulates that it "MUST NOT" send a Date header field. By default, uvicorn adds a Date header to each response. This change adds the date_header flag to Config, as well as the commandline option --no-date-header, through which this behaviour can be disabled.

* Support disabling default Server header (encode#688) Section 7.4.2 of RFC 7231 states that "an origin server MAY generate a Server field in its responses." The "MAY" means that sending this header is entirely optional. While the implementation of encode#321 allowed applications to override the Server header, there was no way to disable the Server header altogether. By default, uvicorn adds a Server header to each response that doesn't have one through other means. This change adds the server_header flag to Config, as well as the commandline option --no-server-header, through which this behaviour can be disabled. * Support disabling default Date header When an origin server does not have a sufficiently reliable clock, section 7.1.1.2 of RFC 7231 stipulates that it "MUST NOT" send a Date header field. By default, uvicorn adds a Date header to each response. This change adds the date_header flag to Config, as well as the commandline option --no-date-header, through which this behaviour can be disabled.

zomglings mentioned this pull request Oct 21, 2020

uvicorn zomglings/locust-demo#12

Open

euri10 reviewed Jun 7, 2021

View reviewed changes

euri10 self-assigned this Jun 7, 2021

euri10 added the enhancement label Jun 7, 2021

euri10 reviewed Jun 8, 2021

View reviewed changes

tests/test_default_headers.py Show resolved Hide resolved

euri10 reviewed Jun 8, 2021

View reviewed changes

docs/deployment.md Outdated Show resolved Hide resolved

euri10 approved these changes Jun 9, 2021

View reviewed changes

Kludex added the hold Don't merge yet label Jun 9, 2021

euri10 requested changes Jun 10, 2021

View reviewed changes

Kludex removed the hold Don't merge yet label Jun 10, 2021

stiiin added 2 commits June 10, 2021 22:18

euri10 approved these changes Jun 11, 2021

View reviewed changes

euri10 merged commit df23249 into encode:master Jun 11, 2021

Kludex reviewed Jun 11, 2021

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support disabling default Server and Date headers #818

Support disabling default Server and Date headers #818

stiiin commented Oct 14, 2020 •

edited by euri10

Loading

euri10 commented Jun 7, 2021

euri10 left a comment

euri10 commented Jun 7, 2021

stiiin commented Jun 7, 2021 •

edited

Loading

euri10 commented Jun 8, 2021 •

edited

Loading

stiiin commented Jun 8, 2021

euri10 left a comment

stiiin commented Jun 10, 2021

euri10 commented Jun 11, 2021

Kludex left a comment

Kludex Jun 10, 2021

Kludex Jun 10, 2021

Kludex Jun 10, 2021

stiiin Jun 11, 2021

Kludex Jun 11, 2021

Kludex Jun 10, 2021

	async def test_disable_default_server_header():
	async def test_disable_server_header():



		@pytest.mark.asyncio
		async def test_disable_default_date_header():

	async def test_disable_default_date_header():
	async def test_disable_date_header():

	help="Enable/Disable default Server header.",
	help="Enable/Disable server header.",

	help="Enable/Disable default Date header.",
	help="Enable/Disable date header.",

Support disabling default Server and Date headers #818

Support disabling default Server and Date headers #818

Conversation

stiiin commented Oct 14, 2020 • edited by euri10 Loading

euri10 commented Jun 7, 2021

euri10 left a comment

Choose a reason for hiding this comment

euri10 commented Jun 7, 2021

stiiin commented Jun 7, 2021 • edited Loading

euri10 commented Jun 8, 2021 • edited Loading

stiiin commented Jun 8, 2021

euri10 left a comment

Choose a reason for hiding this comment

stiiin commented Jun 10, 2021

euri10 commented Jun 11, 2021

Kludex left a comment

Choose a reason for hiding this comment

Kludex Jun 10, 2021

Choose a reason for hiding this comment

Kludex Jun 10, 2021

Choose a reason for hiding this comment

Kludex Jun 10, 2021

Choose a reason for hiding this comment

stiiin Jun 11, 2021

Choose a reason for hiding this comment

Kludex Jun 11, 2021

Choose a reason for hiding this comment

Kludex Jun 10, 2021

Choose a reason for hiding this comment

stiiin commented Oct 14, 2020 •

edited by euri10

Loading

stiiin commented Jun 7, 2021 •

edited

Loading

euri10 commented Jun 8, 2021 •

edited

Loading