haskell-servant/servant

API construction is too lenient

Open

#659 创建于 2017年1月11日

在 GitHub 查看
 (6 评论) (0 反应) (0 负责人)Haskell (422 fork)batch import
help wanted

仓库指标

Star
 (1,953 star)
PR 合并指标
 (平均合并 5小时 49分钟) (30 天内合并 2 个 PR)

描述

All of the following compile, but produce code which is nonsense in practice:

  • Static path parts containing slashes:

    "api/v1/item" :> Get '[JSON] [Item]
    

    This should be done as "api" :> "v1" :> "item" :> ..., and the resulting API is not functional.

  • Case-sensitive headers:

      Header "Authentication" String :> Header "authentication" String :> "item" :> Get '[JSON] [Item]
    

    According to the RFC, header names are case sensitive. Servant already handles this correctly by assigning the same value to both if either is set, but allowing both to be defined could theoretically result in hard-to-find bugs, as a client can send both at the same time.

  • Duplicate headers:

      Header "authentication" String :> Header "authentication" String :> "item" :> Get '[JSON] [Item]
    

    Obviously, the resulting server will be passed two identical values. This should not be allowed, as some external code which parses this may rely on the uniqueness of headers.

I'm not sure if it's even technically possible to prevent those from compiling, but it would be nice to have.

贡献者指南