benoitc
9357b28dd8
keep document user in access_log_format setting
2024-08-10 10:19:36 +02:00
benoitc
79fdef0822
bump to 23.0.0
2024-08-10 10:06:36 +02:00
Benoit Chesneau
3acd9fbfd1
Merge pull request #2620 from talkerbox/improve-access-log-format-docs
...
Improve access-log-format documentation section
2024-08-10 09:56:56 +02:00
Benoit Chesneau
3f56d76548
Merge pull request #3192 from pajod/patch-allowed-script-name
...
22.0.0 regression: We need a better default treatment of SCRIPT_NAME
2024-08-09 09:05:57 +02:00
Paul J. Dorn
256d474a79
docs: revert duped directive
2024-08-09 00:28:08 +02:00
Paul J. Dorn
ffa48b581d
test: default change was intentional
2024-08-08 18:37:32 +02:00
Paul J. Dorn
52538ca907
docs: recommend SCRIPT_NAME=/subfolder
2024-08-08 18:32:23 +02:00
Paul J. Dorn
687b78d20c
config defaults: PATH_NAME and ::1 for proxy
...
* PATH_NAME is used like SCRIPT_NAME: include both
* replicate changed forwarded-allow-ips default to proxy_allow_ips
2024-08-08 18:15:42 +02:00
Benoit Chesneau
06d537d55b
Merge pull request #3254 from pajod/patch-header-trailing-ws
...
Strip trailing optional whitespace (OWS) from single-line header field values
2024-08-08 15:12:29 +02:00
Paul J. Dorn
5bbf373e18
undocumented allow-all for forwarder-headers
2024-08-07 20:15:17 +02:00
Paul J. Dorn
3e042e8269
Configurable list of forwarder headers
2024-08-07 20:15:13 +02:00
Paul J. Dorn
01bcdb1d12
Exempt SCRIPT_NAME from newly introduced --header-map treatment
2024-08-07 20:10:47 +02:00
Paul J. Dorn
2bc931e7d9
whitespace handling in header field values
...
Strip whitespace also *after* header field value.
Simply refuse obsolete header folding (a default-off
option to revert is temporarily provided).
While we are at it, explicitly handle recently
introduced http error classes with intended status code.
2024-08-07 19:42:16 +02:00
Benoit Chesneau
77b65a0934
Merge pull request #3191 from pajod/patch-severity
...
logging: swap error/debug severity on socket creation failure
2024-08-07 19:25:31 +02:00
Benoit Chesneau
56324bef7a
Merge pull request #3217 from pajod/patch-docs
...
CI: verify docs are up to date
2024-08-07 19:23:23 +02:00
Paul J. Dorn
ce039ca71a
Swap error/debug severity
...
debug message: will now sleep(1)
error message: this is what went wrong
2024-08-07 19:02:37 +02:00
Paul J. Dorn
6c3296e177
update docs
...
re-apply typo fix from 628a0bcb61ef3a211d67dfd68ad1ba161cccb3b8
reflect removal of setting from 555d2fa27f2d891f23bd03890e4a826b5018c6b4
2024-08-07 18:21:36 +02:00
Paul J. Dorn
e3562c94d3
doc: news for 2024
2024-08-07 18:21:35 +02:00
Paul J. Dorn
6245e2c03b
docs: unresolved reference (the reference is not named after the class name)
2024-08-07 18:16:20 +02:00
Paul J. Dorn
2a3dfdd2c8
CI: verify docs up to date
2024-08-07 18:16:20 +02:00
Benoit Chesneau
2c38b036a2
Update design.rst
...
make the asyncio docs more explicit.
YODO: revisit this documentation later to be more exhaustive
2024-08-07 09:12:44 +02:00
Benoit Chesneau
ad7c1de132
Merge pull request #3080 from odyfatouros/Fix-#3079-worker_class-parameter-accepts-class
...
Fix for issue #3079 , worker_class parameter accepts a class
2024-08-07 08:47:20 +02:00
Benoit Chesneau
52234e7b32
Merge pull request #2688 from StarfishStorage/fix_2684
...
Fix problem that may happen after interrupted chunk-encoding request
2024-08-07 00:24:46 +02:00
Benoit Chesneau
c5727ac92c
Merge pull request #3089 from pataquets/patch-1
...
news.rst: fix minor typo
2024-08-07 00:20:17 +02:00
Benoit Chesneau
5f820ce37c
Merge pull request #3167 from tbascoul/tiny-example-config-fix
...
update example_config with latest settings
2024-08-07 00:19:34 +02:00
Benoit Chesneau
ff2109e759
Merge pull request #3260 from benoitc/fix-te
...
don't tolerate wrong te headers
2024-08-07 00:15:56 +02:00
benoitc
555d2fa27f
don't tolerate wrong te headers
...
changes:
- Just follow the new TE specification (https://datatracker.ietf.org/doc/html/rfc9112#name-transfer-encoding )
here and accept to introduce a breaking change.
- gandle multiple TE on one line
** breaking changes ** : invalid headers and position will now return
an error.
2024-08-06 23:47:01 +02:00
Benoit Chesneau
9a96e75808
Merge pull request #3253 from pajod/patch-rfc9110-section5.5
...
Refuse requests with invalid and dangerous CR/LF/NUL in header field value, as demanded by rfc9110 section 5.5
2024-08-06 22:25:12 +02:00
Benoit Chesneau
cefa314c62
Merge pull request #3257 from pajod/patch-no-docs-build-in-sdist
...
exclude generate html files from source tarballs (sdist)
2024-08-06 19:38:26 +02:00
Benoit Chesneau
5c0e1571dc
Merge pull request #3255 from pajod/patch-refuse-empty-request-target
...
refuse empty request-target in HTTP request
2024-08-06 18:26:47 +02:00
Benoit Chesneau
26c22af2e7
Merge pull request #2336 from elendiastarman/gevent-statsd-fix
...
Fixed two bugs related to gevent + gunicorn + statsd.
2024-08-06 18:08:18 +02:00
Benoit Chesneau
5e39f88622
Update tornadoapp.py
2024-08-06 17:50:16 +02:00
Benoit Chesneau
7f559886cb
Merge pull request #3258 from pajod/patch-empty-chunksize
...
gracefully handle chunked encoding missing size
2024-08-06 13:20:52 +02:00
Paul J. Dorn
cabc666277
chunked encoding: example invalid requests
2024-07-31 19:21:07 +02:00
Paul J. Dorn
a3d130ae51
gracefully handle chunked encoding missing size
...
Treat it the same as invalid characters where size should be.
2024-07-31 18:32:02 +02:00
Paul J. Dorn
70a1e437b5
forbid lone CR/LF and NUL in headers (docs)
2024-07-31 17:39:13 +02:00
Paul J. Dorn
7c3e9c9c2b
docs: clarify Makefile is generated
2024-07-31 04:18:20 +02:00
Paul J. Dorn
2669016abe
docs: https-capable sphinx homepage entry point
2024-07-31 04:18:20 +02:00
Paul J. Dorn
4b48ebe86b
no docs/build in sdist
...
alternate spelling _build covers new defaults of regenerated sphinx Makefile
2024-07-31 04:18:15 +02:00
Paul J. Dorn
9ca4f1fdfc
refuse empty request-target in HTTP request
...
A single slash is valid, but nothing at all can be safely refused.
Python stdlib explicitly tells us it will not perform validation.
https://docs.python.org/3/library/urllib.parse.html#url-parsing-security
There are *four* `request-target` forms in rfc9112, none of them can be empty.
2024-07-31 02:14:35 +02:00
Paul J. Dorn
eda9d456d3
forbid lone CR/LF and NUL in headers
...
New parser rule: refuse HTTP requests where a header field value
contains characters that
a) should never appear there in the first place,
b) might have lead to incorrect treatment in a proxy in front, and
c) might lead to unintended behaviour in applications.
From RFC 9110 section 5.5:
"Field values containing CR, LF, or NUL characters are invalid and
dangerous, due to the varying ways that implementations might parse
and interpret those characters; a recipient of CR, LF, or NUL within
a field value MUST either reject the message or replace each of those
characters with SP before further processing or forwarding of that
message."
2024-07-31 01:28:30 +02:00
Paul J. Dorn
e3fa50d1c5
update docs
2024-07-31 01:21:01 +02:00
Benoit Chesneau
79b9a52cc8
Merge pull request #3196 from washeck/3195-http-version-error
...
Fix InvalidHTTPVersion exception str method
2024-07-04 15:13:43 +02:00
Benoit Chesneau
405c3ca35e
Merge pull request #3211 from pajod/patch-macos14-no-eol-python
...
CI: revert macos-14 runners, migrate to tox v4-exclusive settings, add Python 3.13
2024-07-04 15:11:57 +02:00
Benoit Chesneau
9802e21f77
Merge pull request #3214 from boxydog/doc_prefork
...
Document server hooks in a custom application
2024-05-22 04:21:04 +02:00
boxydog
0f20019113
Document server hooks in a custom application
2024-05-18 14:20:42 -05:00
Paul J. Dorn
8fe034ef7c
CI: run entry point tests without deps, run lint without package build steps
2024-05-13 01:09:16 +02:00
Paul J. Dorn
9949e34e96
CI: also try Python 3.13 (at this time beta 1)
2024-05-13 01:04:50 +02:00
Paul J. Dorn
3d00696397
CI: revert macos-14 for Github runners
2024-05-13 00:50:20 +02:00
Vaclav Rehak
97f87ec13e
Fix InvalidHTTPVersion exception str method
...
Fixes : #3195
2024-04-26 13:58:10 +02:00
