[Development] Proposal for allowing handling of HTTP redirects in QNAM

[Richard Moore]

On 24 December 2013 07:57, Mandeep Sandhu <mandeepsandhu.chd at gmail.com> wrote:
> Hi All,
>
> Few days back I stumbled upon this task:
> https://bugreports.qt-project.org/browse/QTBUG-8232
>
> "QNetworkAccessManager should support redirection"
>
> I think this is a useful feature that can be added to QNAM as it makes
> the life of a developer easy.
>
> I went through all the comments in the task page, libcurl
> documentation and also saw how some other libraries, like Python's
> urllib, handle redirection.
>
> I'm collating all that info here as a proposal for new functionality
> to QNAM and friends:
>
> 1. Allow handling of redirects at both global (QNAM) and per request
> (QNetworkRequest) level. Per request setting overrides global setting.
> Default will be to NOT handle redirects.
>
> 2. New "redirected(QUrl)" signal to be emitted in case auto-redirects
> are enabled and a redirection occurs.

This interface wouldn't be enough to let you distinguish between the
different types of redirect, though tbh I'm not sure that matters.

>
> 3. QNetworkReply stores both, the original as well as the final url.

What about the intermediate ones in a chain of redirects?

> 4. Allow setting of "max redirect" to avoid infinite redirections.
>
> 5. Allow a way to specify which protocols are allowed on redirects.
> Eg: curl by default does not redirect to "file" and "scp" protocols.

I don't think that should be offered. We pretty much concluded that
same-protocol redirects were okay, as were http -> https but others
were a mine field. https->http is one that I'm still unsure of since
it's one we see in real life, but has potential risks. If an app needs
detailed control (eg. as a browser does) then it should implement the
handling itself. QNAM should only handle the simple case.

>
> 6. Allow a way to specify redirect behaviour for POST requests. Eg: if
> a 301 is returned, the RFC states that the user agent MUST NOT change
> it to a GET request automatically.

IIRC the RFC is wrong or at least incomplete here and does not
describe actual behaviour of browsers. See
http://en.wikipedia.org/wiki/Post/Redirect/Get for more details.


> 7. New error code in QNetworkReply to indicate "too many redirects" error.
>
> The last update on this task was more than a year back. So I'm not
> sure if someone's already worked on it or if it's been abandoned due
> to some issue.
>
> I was wondering if a patch for it will be acceptable?

Sure, however it's quite involved. From inside the http backend you
need to start a new request meaning there's not a 1:1 mapping between
user requests and the internal ones. This is similar to what happens
with proxy auth etc. so you should look at the code that implements
that for inspiration.

Cheers

Rich.