Re: [PATCH] http-backend: give a hint that web browser access is not supported

From: Junio C Hamano <gitster@pobox.com>
Date: Dec 5, 2021, 01:17 UTC
Message-ID: <xmqqtufnonor.fsf@gitster.g>
In-Reply-To: <7r23s082-o3q0-479o-srqn-r45q778s5nq7@vanv.qr>

Jan Engelhardt <jengelh@inai.de> writes:

Show 20 quoted lines

> On Saturday 2021-12-04 09:09, Junio C Hamano wrote:
>
>>Jan Engelhardt <jengelh@inai.de> writes:
>>
>>> When using a browser to access a URI that is served by http-backend,
>>> nothing but a blank page is shown. This is not helpful.
>>>
>>> Emit the same "Request not handled" messages, but to the CGI stream
>>
>>Puzzled.  Same with what?
>
> "Request not handled" is already sent to stderr, which means it (only)
> shows up in the httpd error log.
>
> So now we send "Request not handled" also to stdout, which is what
> the browser will see.
>
>>What is in "pathinfo" parameter?
>
> It is getenv("PATH_INFO").

That part I know. The question was what would a typical value of that parameter look like in the context of somebody mistakenly visiting Git smart HTTP endpoint via their browser.

I am basically wondering if it is helping the user enough, or if it is sufficient to give just the "err" and "hint", and nothing else.

> Yes, that seems more like it. I was not aware of send_strbuf.

Heh, I wasn't either. The review of this topic was the first time I seriously read any part of that file, and I think I still only read just about 20% of it ;-)

Also, will the real Git clients, which are the primary intended audiences this program is trying to talk to, be OK if we suddenly start giving a non-empty 404 page?

If any implementations of Git HTTP client this program is serving (1) uses a 404 response as a cue to decide its next request (e.g. there may be some "try this URL and if it fails, do another one" fallback logic), and (2) depends on our 404 response to be without any body, we'd be breaking the service for our primary audience, only to mollify those who visit our HTTP endpoint that they should not be visiting in the first place via the browser, which would be worse than embarrassing.

Thanks.