plack / Plack

PSGI toolkit and server adapters
http://plackperl.org/
Other
486 stars 214 forks source link

Move MSIE fixes into separate middleware? #666

Closed robrwo closed 2 years ago

robrwo commented 3 years ago

The ConditionalGET middleware has a workaround for malformed Internet Explorer headers, from 2009.

Internet Explorer is no longer supported my Microsoft on many of their web servers, and is due to be abandoned by August-October 2021. Many web frameworks and web sites are dropping support for Internet Explorer.

It might be worth removing any IE-specific workarounds, and instead moving them into separate middleware that rewrites requests/responses for Internet Explorer. (The middleware could be released as a separate distribution as well.)

robrwo commented 2 years ago

Likewises, the IIS-fix middleware could also be moved to separate distributions since they address versions of IIS from before 2009.

haarg commented 2 years ago

I don't see how ConditionalGET is related to IE at all.

robrwo commented 2 years ago

I don't see how ConditionalGET is related to IE at all.

Like 58 of the version on CPAN 1.0048:

sub _value {
    my $str = shift;
    # IE sends wrong formatted value(i.e. "Thu, 03 Dec 2009 01:46:32 GMT; length=17936")
    $str =~ s/;.*$//;
    return $str;
}
miyagawa commented 2 years ago

To my eyes that code is more of a defense in depth against broken clients in general, and won't affect other clients (hence no User-Agent checking), and is not worth splitting to its own.

robrwo commented 2 years ago

To my eyes that code is more of a defense in depth against broken clients in general

How many clients in use besides old versions of IE have that problem?

I see it as running code that is no longer necessary. The advantage is that it reduces the the amount of code run, and disadvantage (for the very small number of clients) is that they receive the full response instead of the 304 with no body.

miyagawa commented 2 years ago

The syntax of If-Modified-Since doesn't allow ; so what I see it as doing is to strip the invalid tokens from the value before doing the comparison, rather than special-casing IE. I believe you're right that nobody would complain if it didn't exist from the start, but to me that's the robustness principle of "be conservative in what you do, be liberal in what you accept."

robrwo commented 2 years ago

No problems, then.