mysociety / alaveteli

Provide a Freedom of Information request system for your jurisdiction
https://alaveteli.org
Other
389 stars 195 forks source link

Requests to `/request/$REQUEST_ID.json` do not redirect to JSON file #8086

Closed mdeuk closed 8 months ago

mdeuk commented 8 months ago

What happened?

Since #8058 was deployed, it appears that requests to /request/$REQUEST_ID.json (where $REQUEST_ID is the numeric request ID) fail, as the browser is redirected to /request/$REQUEST_URL_NAME, which renders in html, instead of json.

Expected result

The original request should be honoured, with the redirect returning the JSON file (content-type: application/json)

Actual result

A 301 is returned, with the location missing the .json extension, which causes the result to be returned in HTML.

curl -i https://www.whatdotheyknow.com/request/$REQUEST_ID.json
HTTP/2 301
server: nginx
date: Tue, 09 Jan 2024 16:30:24 GMT
content-type: text/html
content-length: 124
cache-control: no-cache
strict-transport-security: max-age=631139040; includeSubdomains
x-permitted-cross-domain-policies: none
x-xss-protection: 1
x-request-id: c8636724-41da-47e9-ae4f-6bd089cf3f35
x-frame-options: sameorigin
x-content-type-options: nosniff
location: https://www.whatdotheyknow.com/request/$REQUEST_URL_NAME
status: 301 Moved Permanently
x-url: /request/$REQUEST_ID.json
x-host: www.whatdotheyknow.com
age: 0

<html><body>You are being <a href="https://www.whatdotheyknow.com/request/$REQUEST_URL_NAME">redirected</a>.</body></html>

Workaround

The workaround is to iterate, and add .json to the resulting url, which works as expected - but this may break some tooling which relies on hardcoded values.

Related

HelenWDTK commented 8 months ago

+1 This will have also broken some of the scripts that I use.