amadan

carlos / platform Public

edge: the static validator is the file's content, not its version name or mtime

Astra's review of the first cut (accept with fixes), each finding
reproduced as a failing test before the change:

- A version name is not a fact about the bytes: a pruned version can be
  re-shipped under its old name, and a hostname can move between two
  apps that both have a v1. The tag is now a hash of the file's content,
  memoized per file. An unchanged file keeps its tag across a deploy.
- A browser whose copy predates the ETag revalidates on the date alone,
  and an extraction mtime answers that wrongly after a rollback. The
  handler serves the file itself and offers no Last-Modified.
- The edge weakens a strong ETag when it gzips a 200 but not on the 304
  or a HEAD. The tag is weak from the start, so it reads the same on
  all three. If-Range falls back to the whole file.
- The comment claimed no-cache on every answer; net/http strips it from
  its own 416 and 400.

Declined: adding Vary: Accept-Encoding to 304s. The compressor omits it
for every route, not only static ones, and that belongs in compress.go.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude 08bd871543b1aaba2cc9a6ce6e28f667088e9120 parent d758ead
2 files changed, +340 −56
  • internal/edge/static.go +130 −25
  • internal/edge/static_cache_test.go +210 −31

CI passed — run details

diff --git a/internal/edge/static.go b/internal/edge/static.go
index da2eba89c..89aedc5f9 100644
--- a/internal/edge/static.go
+++ b/internal/edge/static.go
@@ -26,6 +26,7 @@ import (
"path"
"path/filepath"
"sort"
+ "strings"
"sync"
"time"
@@ -121,6 +122,12 @@ type staticSite struct {
mu sync.Mutex
version string // currently served version; "" until first resolve
checkedAt time.Time // when the pointer was last read
+
+ // tags memoizes fileTag by extracted file path. Its own lock, not mu:
+ // requests hash and look up concurrently, and mu is held across a
+ // pointer read.
+ tagMu sync.Mutex
+ tags map[string]string
}
// newStaticHandler builds the serving handler for one static route. The
@@ -163,16 +170,19 @@ func (s *staticSite) ServeHTTP(w http.ResponseWriter, r *http.Request) {
// Set before any body is written, so it lands on the tree's own 404s too
// (the handler serving that tree IS a version).
w.Header().Set("X-Carlos-Version", version)
- // Every answer out of the tree is revalidated, its 404s included. With
- // Last-Modified alone a browser GUESSES a freshness lifetime — typically a
- // tenth of the file's age — and reuses its copy without asking, so a site
- // last deployed a month ago kept showing the old page for days after the
- // next deploy (discussion #195). no-cache is "store it, but ask first";
- // the ETag serveTree sets is what makes asking cost a 304. It also keeps
- // these responses out of the edge's own shared cache, which admits only a
- // positive lifetime — as they always were, having named none.
+ // A page out of the tree is revalidated before it is reused, and so is
+ // the tree's own 404. With Last-Modified alone a browser GUESSES a
+ // freshness lifetime — typically a tenth of the file's age — and reuses
+ // its copy without asking, so a site last deployed a month ago kept
+ // showing the old page for days after the next deploy (discussion #195).
+ // no-cache is "store it, but ask first"; the ETag serveTree sets is what
+ // makes asking cost a 304. It also keeps these responses out of the
+ // edge's own shared cache, which admits only a positive lifetime — as
+ // they always were, having named none. (net/http strips the header again
+ // from the errors it writes itself, a 416 or a 400: neither is a status a
+ // browser caches on a guess.)
w.Header().Set("Cache-Control", "no-cache")
- s.serveTree(dir, version, w, r)
+ s.serveTree(dir, w, r)
}
// dir is where version's tree lives once extracted.
@@ -219,6 +229,9 @@ func (s *staticSite) currentDir(ctx context.Context) (dir, version string, err e
return s.stale(fmt.Errorf("swap current -> %s: %w", cp.Version, err))
}
s.version = cp.Version
+ s.tagMu.Lock()
+ s.tags = nil // the memo's paths are the previous tree's
+ s.tagMu.Unlock()
}
s.checkedAt = time.Now()
return s.dir(s.version), s.version, nil
@@ -373,18 +386,25 @@ func extractSiteTar(data []byte, dst string) error {
// http.FileServer semantics with index.html for directories and a clean 404
// (never a directory listing) when neither the file nor an index exists.
//
-// The validator is the VERSION, never the file's mtime. An extracted tree's
-// mtimes say when THIS box unpacked it: they differ between edges serving the
-// same build, and they run backwards on a rollback — the tree rolled back to
-// was unpacked before the one the browser holds, so If-Modified-Since alone
-// answers "not modified" and the browser keeps the build that was withdrawn.
-// A version names its bytes exactly (trees are immutable once extracted), is
-// the same on every edge, and http.ServeFile checks If-None-Match ahead of
-// If-Modified-Since. One value for every path is sound: an entity tag is
-// scoped to its URL. version is path-safe by construction (ValidVersion:
-// [a-zA-Z0-9._-]), so it needs no quoting beyond the quotes. The edge's
-// compression weakens it when it gzips (compress.go, weakenETag).
-func (s *staticSite) serveTree(dir, version string, w http.ResponseWriter, r *http.Request) {
+// It serves the file itself rather than through http.ServeFile, because
+// ServeFile offers the file's mtime as Last-Modified and answers
+// If-Modified-Since from it — and an extracted file's mtime is when THIS box
+// unpacked the tree, which is not a fact about the content. It differs
+// between edges serving the same release, and it runs backwards on a
+// rollback: the tree rolled back to was unpacked before the one the browser
+// holds, so "modified since?" answers no and the browser keeps the build that
+// was withdrawn. No date is offered, so there is none to compare.
+//
+// The validator is the file's content (fileTag). What ServeFile did besides
+// is kept by hand: the refusal of a ".." element, and the redirect off a
+// trailing /index.html onto its directory.
+func (s *staticSite) serveTree(dir string, w http.ResponseWriter, r *http.Request) {
+ if containsDotDot(r.URL.Path) {
+ // The Clean below would resolve it harmlessly inside the tree; this
+ // keeps the answer ServeFile always gave such a path.
+ http.Error(w, "invalid URL path", http.StatusBadRequest)
+ return
+ }
// Clean rooted at "/" so no request path can climb out of the tree.
p := path.Clean("/" + r.URL.Path)
fp := filepath.Join(dir, filepath.FromSlash(p))
@@ -397,8 +417,93 @@ func (s *staticSite) serveTree(dir, version string, w http.ResponseWriter, r *ht
http.NotFound(w, r)
return
}
- // ServeFile brings Content-Type, ranges and the conditional-request
- // handling for free; it honours an ETag set before the call.
- w.Header().Set("ETag", `"`+version+`"`)
- http.ServeFile(w, r, fp)
+ if strings.HasSuffix(r.URL.Path, "/index.html") {
+ // Relative, as ServeFile wrote it, so it survives any prefix the
+ // request arrived under.
+ loc := "./"
+ if q := r.URL.RawQuery; q != "" {
+ loc += "?" + q
+ }
+ w.Header().Set("Location", loc)
+ w.WriteHeader(http.StatusMovedPermanently)
+ return
+ }
+ f, err := os.Open(fp)
+ if err != nil {
+ http.NotFound(w, r)
+ return
+ }
+ defer f.Close()
+ if tag, err := s.fileTag(fp, f); err == nil {
+ w.Header().Set("ETag", tag)
+ } else {
+ // No tag is the honest answer: the response then carries no
+ // validator and no-cache makes the browser refetch it whole.
+ log.Printf("edge: static %s/%s: tag %s: %v", s.app, s.channel, p, err)
+ }
+ // ServeContent brings Content-Type, ranges and the conditional-request
+ // handling; the zero time is "no Last-Modified, and no date to test".
+ http.ServeContent(w, r, fi.Name(), time.Time{}, f)
+}
+
+// fileTag is the entity tag for one extracted file: a hash of its bytes.
+//
+// The content, and nothing that merely names it. A version name is reused —
+// a pruned version re-shipped under its old name is a new release
+// (release.putImmutable), and a hostname can move between two apps that both
+// have a "v1" — so a tag made of the name would hand a browser a 304 over
+// bytes it does not hold. Hashing also means identical bytes get one tag on
+// every edge, and a file a deploy did not touch keeps its tag across it: the
+// release that changed one page does not make every browser refetch every
+// asset.
+//
+// WEAK, although a hash of the identity bytes is as strong as a validator
+// gets. The edge gzips compressible responses above this handler and weakens
+// a strong tag when it does (compress.go, weakenETag) — but only on the 200.
+// A 304 and a HEAD pass through as they are, so a strong tag would come back
+// weak on the page and strong on its own revalidation, and a cache may not
+// update the one from the other. Weak from the start, it reads the same on
+// all three. The cost is that If-Range falls back to the whole file.
+//
+// Memoized per file: extracted trees are immutable, so a path hashes once for
+// as long as this handler serves its version. The memo is dropped when the
+// version changes (the paths are the old tree's) and with the handler itself,
+// so it never outgrows one tree's worth of the files actually requested.
+func (s *staticSite) fileTag(fp string, f *os.File) (string, error) {
+ s.tagMu.Lock()
+ tag, ok := s.tags[fp]
+ s.tagMu.Unlock()
+ if ok {
+ return tag, nil
+ }
+ h := sha256.New()
+ if _, err := io.Copy(h, f); err != nil {
+ return "", err
+ }
+ if _, err := f.Seek(0, io.SeekStart); err != nil {
+ return "", err
+ }
+ tag = `W/"` + hex.EncodeToString(h.Sum(nil)[:16]) + `"`
+ s.tagMu.Lock()
+ if s.tags == nil {
+ s.tags = map[string]string{}
+ }
+ s.tags[fp] = tag
+ s.tagMu.Unlock()
+ return tag, nil
+}
+
+// containsDotDot reports whether a URL path has a ".." element — net/http's
+// own test, which http.ServeFile applied before this handler served files
+// itself.
+func containsDotDot(p string) bool {
+ if !strings.Contains(p, "..") {
+ return false
+ }
+ for _, el := range strings.FieldsFunc(p, func(r rune) bool { return r == '/' || r == '\\' }) {
+ if el == ".." {
+ return true
+ }
+ }
+ return false
}
diff --git a/internal/edge/static_cache_test.go b/internal/edge/static_cache_test.go
index d1bb8b53e..6ff1ef5d1 100644
--- a/internal/edge/static_cache_test.go
+++ b/internal/edge/static_cache_test.go
@@ -4,57 +4,93 @@ import (
"context"
"io"
"net/http"
+ "net/http/httptest"
+ "path/filepath"
+ "strings"
"testing"
+ "github.com/carlosframework/platform/internal/registry"
"github.com/carlosframework/platform/internal/release"
)
-// condGet is a GET with the validators a browser holding a cached copy sends.
-func condGet(t *testing.T, base, host, path string, hdr map[string]string) (*http.Response, string) {
+// reqStatic is one request the way a browser holding a cached copy makes it:
+// no redirect following, no transparent gzip (an explicit Accept-Encoding
+// turns the client's own off), and the validators in hdr.
+func reqStatic(t *testing.T, method, base, path string, hdr map[string]string) (*http.Response, string) {
t.Helper()
- req, err := http.NewRequest("GET", base+path, nil)
+ req, err := http.NewRequest(method, base+path, nil)
if err != nil {
t.Fatalf("new request: %v", err)
}
- req.Host = host
+ req.Host = "site.example.com"
for k, v := range hdr {
req.Header.Set(k, v)
}
- resp, err := http.DefaultClient.Do(req)
+ client := &http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
+ resp, err := client.Do(req)
if err != nil {
- t.Fatalf("GET %s%s (host %s): %v", base, path, host, err)
+ t.Fatalf("%s %s%s: %v", method, base, path, err)
}
defer resp.Body.Close()
b, _ := io.ReadAll(resp.Body)
return resp, string(b)
}
+// siteServer ships files as version of app into its own store and serves it
+// from a fresh handler, behind the same compression wrapper the edge applies.
+func siteServer(t *testing.T, app, version string, files map[string]string) *httptest.Server {
+ t.Helper()
+ store := release.NewDirStore(filepath.Join(t.TempDir(), "store"))
+ priv, pub := testKeys(t)
+ shipSite(t, store, app, version, files)
+ if err := release.Promote(context.Background(), store, priv, release.OpsAccount, app, "canary/x", version); err != nil {
+ t.Fatalf("Promote %s: %v", version, err)
+ }
+ rt := registry.Route{Host: "site.example.com", Kind: "static", App: app, Channel: "canary/x", Status: "ready"}
+ h := newStaticHandler(rt, store, pub, filepath.Join(t.TempDir(), "cache"))
+ h.(*staticSite).recheck = 0
+ srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ if gw := newGzipWriter(w, r); gw != nil {
+ w = gw
+ defer gw.finish()
+ }
+ h.ServeHTTP(w, r)
+ }))
+ t.Cleanup(srv.Close)
+ return srv
+}
+
// A static response used to carry Last-Modified and nothing else, and a
// browser handed only that guesses a freshness lifetime — typically a tenth of
// the file's age — and reuses its copy without asking. A site last deployed a
// month ago kept showing the old page for days after the next deploy
-// (discussion #195). no-cache makes every load ask; the version ETag makes the
-// answer a cheap 304 until a deploy actually changes it.
+// (discussion #195). no-cache makes every load ask; the ETag makes the answer
+// a cheap 304 until the bytes actually change.
func TestStaticResponsesMakeTheBrowserRevalidate(t *testing.T) {
_, _, _, srv := staticFixture(t)
for _, path := range []string{"/", "/docs/page.html", "/style.css"} {
- resp := getPathResp(t, srv.URL, "site.example.com", path)
+ resp, _ := reqStatic(t, "GET", srv.URL, path, nil)
if resp.StatusCode != http.StatusOK {
t.Fatalf("GET %s = %d, want 200", path, resp.StatusCode)
}
if got := resp.Header.Get("Cache-Control"); got != "no-cache" {
t.Errorf("GET %s Cache-Control = %q, want %q", path, got, "no-cache")
}
- if got := resp.Header.Get("ETag"); got != `"v1"` {
- t.Errorf("GET %s ETag = %q, want %q (the version whose tree answered)", path, got, `"v1"`)
+ if got := resp.Header.Get("ETag"); !strings.HasPrefix(got, `W/"`) || len(got) < 20 {
+ t.Errorf("GET %s ETag = %q, want a weak content tag", path, got)
+ }
+ // The mtime of an extracted file is when THIS box unpacked it. It is
+ // not a fact about the content and must not be offered as one.
+ if got := resp.Header.Get("Last-Modified"); got != "" {
+ t.Errorf("GET %s Last-Modified = %q, want none", path, got)
}
}
// The tree's own 404 must not be cached on a guess either: the page it
// stands in for may exist in the next deploy. It names no representation,
// so it carries no validator.
- resp := getPathResp(t, srv.URL, "site.example.com", "/missing.html")
+ resp, _ := reqStatic(t, "GET", srv.URL, "/missing.html", nil)
if resp.StatusCode != http.StatusNotFound {
t.Fatalf("GET /missing.html = %d, want 404", resp.StatusCode)
}
@@ -66,12 +102,11 @@ func TestStaticResponsesMakeTheBrowserRevalidate(t *testing.T) {
}
}
-// The validator is the VERSION, not the file's mtime. An unchanged version
-// revalidates to a 304; a deploy answers 200 with the new bytes; and so does a
-// rollback — where the mtime gets it wrong, because the tree rolled back to was
-// extracted BEFORE the one the browser holds, so If-Modified-Since alone reads
-// "not modified" and the browser keeps the build that was just withdrawn.
-func TestStaticValidatorFollowsTheVersion(t *testing.T) {
+// The validator is the file's CONTENT. Unchanged bytes revalidate to a 304 —
+// across a deploy too, so a release that touched one page does not make every
+// browser refetch every asset — and changed bytes answer 200, in both
+// directions: a rollback is as much a change as a deploy.
+func TestStaticValidatorFollowsTheContent(t *testing.T) {
store, _, priv, srv := staticFixture(t)
promote := func(ver string) {
t.Helper()
@@ -79,29 +114,173 @@ func TestStaticValidatorFollowsTheVersion(t *testing.T) {
t.Fatalf("Promote %s: %v", ver, err)
}
}
+ tagOf := func(path string) string {
+ t.Helper()
+ resp, _ := reqStatic(t, "GET", srv.URL, path, nil)
+ tag := resp.Header.Get("ETag")
+ if resp.StatusCode != http.StatusOK || tag == "" {
+ t.Fatalf("GET %s = %d with ETag %q", path, resp.StatusCode, tag)
+ }
+ return tag
+ }
+ homeV1, cssV1 := tagOf("/"), tagOf("/style.css")
+ if homeV1 == cssV1 {
+ t.Fatalf("two different files share the tag %q", homeV1)
+ }
- resp, _ := condGet(t, srv.URL, "site.example.com", "/", map[string]string{"If-None-Match": `"v1"`})
+ resp, _ := reqStatic(t, "GET", srv.URL, "/", map[string]string{"If-None-Match": homeV1})
if resp.StatusCode != http.StatusNotModified {
- t.Fatalf("revalidating v1 against v1 = %d, want 304", resp.StatusCode)
+ t.Fatalf("revalidating unchanged content = %d, want 304", resp.StatusCode)
+ }
+ // A 304 carries what its 200 would have: the cache updates from it.
+ if got := resp.Header.Get("ETag"); got != homeV1 {
+ t.Errorf("304 ETag = %q, want the 200's %q", got, homeV1)
+ }
+ if got := resp.Header.Get("Cache-Control"); got != "no-cache" {
+ t.Errorf("304 Cache-Control = %q, want %q", got, "no-cache")
}
- shipSite(t, store, "site", "v2", map[string]string{"index.html": "home v2"})
+ // v2 changes the home page and leaves the stylesheet byte-identical.
+ shipSite(t, store, "site", "v2", map[string]string{"index.html": "home v2", "style.css": "body{}"})
promote("v2")
- resp, body := condGet(t, srv.URL, "site.example.com", "/", map[string]string{"If-None-Match": `"v1"`})
+ resp, body := reqStatic(t, "GET", srv.URL, "/", map[string]string{"If-None-Match": homeV1})
if resp.StatusCode != http.StatusOK || body != "home v2" {
- t.Fatalf("revalidating v1 after a deploy = %d %q, want 200 %q", resp.StatusCode, body, "home v2")
+ t.Fatalf("revalidating a changed page after a deploy = %d %q, want 200 %q", resp.StatusCode, body, "home v2")
+ }
+ homeV2 := resp.Header.Get("ETag")
+ if homeV2 == homeV1 {
+ t.Fatalf("the changed page kept the tag %q", homeV1)
}
- if got := resp.Header.Get("ETag"); got != `"v2"` {
- t.Fatalf("ETag after the deploy = %q, want %q", got, `"v2"`)
+ resp, _ = reqStatic(t, "GET", srv.URL, "/style.css", map[string]string{"If-None-Match": cssV1})
+ if resp.StatusCode != http.StatusNotModified {
+ t.Fatalf("revalidating an UNCHANGED file after a deploy = %d, want 304", resp.StatusCode)
}
- v2Modified := resp.Header.Get("Last-Modified")
- promote("v1") // roll back to a tree extracted before v2's
- resp, body = condGet(t, srv.URL, "site.example.com", "/", map[string]string{
- "If-None-Match": `"v2"`,
- "If-Modified-Since": v2Modified,
+ promote("v1") // roll back
+ resp, body = reqStatic(t, "GET", srv.URL, "/", map[string]string{"If-None-Match": homeV2})
+ if resp.StatusCode != http.StatusOK || body != "home v1" {
+ t.Fatalf("revalidating after a rollback = %d %q, want 200 %q", resp.StatusCode, body, "home v1")
+ }
+ if got := resp.Header.Get("ETag"); got != homeV1 {
+ t.Errorf("the rolled-back page's tag = %q, want its original %q", got, homeV1)
+ }
+}
+
+// A browser whose copy predates the ETag holds only the old Last-Modified and
+// revalidates on the date alone. Against an extraction mtime that answer is
+// wrong after a rollback — the tree rolled back to was unpacked BEFORE the one
+// the browser holds, so "modified since?" says no. With no date offered there
+// is nothing to compare, and the browser gets the bytes.
+func TestStaticDateOnlyRevalidationGetsTheBytes(t *testing.T) {
+ _, _, _, srv := staticFixture(t)
+ resp, body := reqStatic(t, "GET", srv.URL, "/", map[string]string{
+ "If-Modified-Since": "Fri, 01 Jan 2100 00:00:00 GMT",
})
if resp.StatusCode != http.StatusOK || body != "home v1" {
- t.Fatalf("revalidating v2 after a rollback = %d %q, want 200 %q", resp.StatusCode, body, "home v1")
+ t.Fatalf("date-only revalidation = %d %q, want 200 %q", resp.StatusCode, body, "home v1")
+ }
+}
+
+// A version NAME is not a fact about the bytes. A pruned version can be
+// re-shipped under its old name with different content, and a hostname can
+// move between two apps that both have a "v1" — in either case a tag made of
+// the name would let a browser keep the old page on a 304.
+func TestStaticSameVersionNameDifferentContent(t *testing.T) {
+ a := siteServer(t, "site", "v1", map[string]string{"index.html": "the first site"})
+ b := siteServer(t, "other", "v1", map[string]string{"index.html": "a different site"})
+
+ respA, _ := reqStatic(t, "GET", a.URL, "/", nil)
+ tagA := respA.Header.Get("ETag")
+ if tagA == "" {
+ t.Fatal("no ETag from the first site")
+ }
+ resp, body := reqStatic(t, "GET", b.URL, "/", map[string]string{"If-None-Match": tagA})
+ if resp.StatusCode != http.StatusOK || body != "a different site" {
+ t.Fatalf("revalidating one v1 against another app's v1 = %d %q, want 200 %q", resp.StatusCode, body, "a different site")
+ }
+
+ // And identical bytes agree wherever they are served from — two edges
+ // unpacking the same release must hand out the same tag.
+ c := siteServer(t, "third", "v9", map[string]string{"index.html": "the first site"})
+ resp, _ = reqStatic(t, "GET", c.URL, "/", map[string]string{"If-None-Match": tagA})
+ if resp.StatusCode != http.StatusNotModified {
+ t.Fatalf("identical bytes from another handler = %d, want 304", resp.StatusCode)
+ }
+}
+
+// The edge gzips a compressible response and, because gzipped bytes are a
+// different representation, weakens a strong ETag as it does — but only on
+// the 200. A 304 and a HEAD pass through untouched, so a strong tag would
+// come back weak on the page and strong on its revalidation, and a cache may
+// not update the one from the other. A tag that is weak from the start reads
+// the same on all three.
+func TestStaticTagIsTheSameCompressedRevalidatedAndOnHead(t *testing.T) {
+ page := "<html>" + strings.Repeat("a page big enough to be worth compressing. ", 200) + "</html>"
+ srv := siteServer(t, "site", "v1", map[string]string{"index.html": page})
+ gz := map[string]string{"Accept-Encoding": "gzip"}
+
+ resp, _ := reqStatic(t, "GET", srv.URL, "/", gz)
+ if resp.StatusCode != http.StatusOK || resp.Header.Get("Content-Encoding") != "gzip" {
+ t.Fatalf("GET / = %d, Content-Encoding %q; want a gzipped 200", resp.StatusCode, resp.Header.Get("Content-Encoding"))
+ }
+ tag := resp.Header.Get("ETag")
+ if !strings.HasPrefix(tag, `W/"`) {
+ t.Fatalf("gzipped 200 ETag = %q, want a weak tag", tag)
+ }
+
+ resp, _ = reqStatic(t, "GET", srv.URL, "/", map[string]string{"Accept-Encoding": "gzip", "If-None-Match": tag})
+ if resp.StatusCode != http.StatusNotModified {
+ t.Fatalf("revalidating the gzipped page = %d, want 304", resp.StatusCode)
+ }
+ if got := resp.Header.Get("ETag"); got != tag {
+ t.Errorf("304 ETag = %q, want the 200's %q", got, tag)
+ }
+
+ resp, _ = reqStatic(t, "HEAD", srv.URL, "/", gz)
+ if got := resp.Header.Get("ETag"); got != tag {
+ t.Errorf("HEAD ETag = %q, want the GET's %q", got, tag)
+ }
+ resp, _ = reqStatic(t, "GET", srv.URL, "/", nil) // identity
+ if got := resp.Header.Get("ETag"); got != tag {
+ t.Errorf("identity GET ETag = %q, want the gzipped GET's %q", got, tag)
+ }
+}
+
+// What http.ServeFile gave for free and this handler must keep now that it
+// serves the file itself: the canonical redirect off /index.html, ranges, and
+// the refusal of a path with a ".." element.
+func TestStaticKeepsServeFileBehaviour(t *testing.T) {
+ _, _, _, srv := staticFixture(t)
+
+ resp, _ := reqStatic(t, "GET", srv.URL, "/index.html?x=1", nil)
+ if resp.StatusCode != http.StatusMovedPermanently || resp.Header.Get("Location") != "./?x=1" {
+ t.Fatalf("GET /index.html = %d, Location %q; want 301 to ./?x=1", resp.StatusCode, resp.Header.Get("Location"))
+ }
+
+ resp, body := reqStatic(t, "GET", srv.URL, "/", map[string]string{"Range": "bytes=0-3"})
+ if resp.StatusCode != http.StatusPartialContent || body != "home" {
+ t.Fatalf("ranged GET = %d %q, want 206 %q", resp.StatusCode, body, "home")
+ }
+ // A weak tag cannot vouch for a byte range: If-Range falls back to the
+ // whole file, which is the safe answer and the documented cost.
+ tag := resp.Header.Get("ETag")
+ resp, body = reqStatic(t, "GET", srv.URL, "/", map[string]string{"Range": "bytes=0-3", "If-Range": tag})
+ if resp.StatusCode != http.StatusOK || body != "home v1" {
+ t.Fatalf("If-Range with a weak tag = %d %q, want the full 200", resp.StatusCode, body)
+ }
+
+ req, err := http.NewRequest("GET", srv.URL+"/", nil)
+ if err != nil {
+ t.Fatal(err)
+ }
+ req.Host = "site.example.com"
+ req.URL.Opaque = "/docs/../index.html" // sent as written, not cleaned by the client
+ resp2, err := http.DefaultClient.Do(req)
+ if err != nil {
+ t.Fatal(err)
+ }
+ resp2.Body.Close()
+ if resp2.StatusCode != http.StatusBadRequest {
+ t.Fatalf("a path with a .. element = %d, want 400", resp2.StatusCode)
}
}