reactphp / http

Event-driven, streaming HTTP client and server implementation for ReactPHP.
https://reactphp.org/http/
MIT License
747 stars 143 forks source link

getFragment() returns empty string, username:password@hostname not supported #499

Closed valzargaming closed 1 year ago

valzargaming commented 1 year ago

Using path http://username:password@10.0.0.25:55555/test/?key=value#anchor and PHP version 8.2.7

$webapi = new HttpServer($loop, function (ServerRequestInterface $request)
{
    var_dump('[WEBAPI URI]', $request->getUri());
    $scheme = $request->getUri()->getScheme();
    $host = $request->getUri()->getHost();
    $port = $request->getUri()->getPort();
    $path = $request->getUri()->getPath();
    $query = $request->getUri()->getQuery();
    $fragment = $request->getUri()->getFragment(); //Doesn't seem to work?
    var_dump('[WEBAPI URL]', $url = "$scheme://$host:$port$path?$query#$fragment");

Output:

string(12) "[WEBAPI URI]"
object(RingCentral\Psr7\Uri)#3628 (7) {
  ["scheme":"RingCentral\Psr7\Uri":private]=>
  string(4) "http"
  ["userInfo":"RingCentral\Psr7\Uri":private]=>
  string(0) ""
  ["host":"RingCentral\Psr7\Uri":private]=>
  string(9) "10.0.0.25"
  ["port":"RingCentral\Psr7\Uri":private]=>
  int(55555)
  ["path":"RingCentral\Psr7\Uri":private]=>
  string(6) "/test/"
  ["query":"RingCentral\Psr7\Uri":private]=>
  string(9) "key=value"
  ["fragment":"RingCentral\Psr7\Uri":private]=>
  string(0) ""
}
string(12) "[WEBAPI URL]"
string(39) "http://10.0.0.25:55555/test/?key=value#"
SimonFrings commented 1 year ago

Hey @valzargaming, the fragment is only used on the client side and are ignored by the server. You can try this out with curl -v https://example.com#hello and taking a look at the headers. Here are some links for more information on this:

RFC 5147: https://www.rfc-editor.org/rfc/rfc5147#section-1.2 Stackoverflow: https://stackoverflow.com/questions/51650538/curl-offers-an-option-to-add-the-url-fragment

I would also suggest to use just the HTTP Authorization header for username and password to avoid accidentally leaking this information (e.g. accidentally dumping the URI in your code).

Hope this helps :+1:

This should answer your question in here, so I'll go ahead and close this ticket for now.