'after_request' runs but headers don't get set #1125
Comments
|
Current master does not have this problem, although if you check out |
|
This issue is still valid in latest stable release which is 0.12.16 at the moment of writting this comment. Particularly fails when working with static_files: @hook('after_request')
def enable_cors_after_request_hook():
print("add_cors_headers")
response.headers['Access-Control-Allow-Origin'] = '*'
response.headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, OPTIONS'
response.headers['Access-Control-Allow-Headers'] = 'Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token'
@get('/benchmark/<feed>/<strategy>/<name>')
def bench_get(feed, strategy, name):
return static_file(name + '.json', root="../benchs/{}/{}".format(feed, strategy))It calls the function but header are not set. |
|
It's solved in 0.13 but this gets reported quite often for 0.12, so I'll look into a backport or pull requests fixing this specific issue for 0.12. Let's keep this issue open for now. |
defnull
added
Bug
|
@defnull This is definitively very annoying, especially for CORS gestion (for example, all errors are wrongly reported as CORS problems). Can you provide a fix for 0.12 version please ? |
defnull
added a commit
that referenced
this issue
Dec 8, 2019
This is a backport of the 0.13 _handle() logic and only changes undefined/undocumented behavior (for the better).
|
Can someone please verify that the current release-12 branch fixes this issue? gh-actions are not executed for 0.12 and travis-ci is broken for old python versions. |
|
I've tested the I also ran the tests with |
|
I think I find an issue. I am using Bottle auth_basic decorator, and it seems that when raising a 401 error, headers are not set. Here is a route without authorization, headers are set. curl http://localhost:8000/ -v
* Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 8000 (#0)
> GET / HTTP/1.1
> Host: localhost:8000
> User-Agent: curl/7.64.1
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: gunicorn/20.0.4
< Date: Tue, 28 Jan 2020 18:06:17 GMT
< Connection: close
< Content-Type: application/json
< Access-Control-Allow-Origin: *
< Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS
< Access-Control-Allow-Headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
< Content-Length: 26
<
* Closing connection 0
{"message": "Hello world"}%Here on a protected route : curl http://localhost:8000/users/me -v
* Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 8000 (#0)
> GET /users/me HTTP/1.1
> Host: localhost:8000
> User-Agent: curl/7.64.1
> Accept: */*
>
< HTTP/1.1 401 Unauthorized
< Server: gunicorn/20.0.4
< Date: Tue, 28 Jan 2020 18:08:33 GMT
< Connection: close
< Www-Authenticate: Basic realm="private"
< Content-Length: 723
< Content-Type: text/html; charset=UTF-8
<
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html>
<head>
<title>Error: 401 Unauthorized</title>
<style type="text/css">
html {background-color: #eee; font-family: sans;}
body {background-color: #fff; border: 1px solid #ddd;
padding: 15px; margin: 15px;}
pre {background-color: #eee; border: 1px solid #ddd; padding: 5px;}
</style>
</head>
<body>
<h1>Error: 401 Unauthorized</h1>
<p>Sorry, the requested URL <tt>'http://localhost:8000/users/me'</tt>
caused an error:</p>
<pre>Access denied</pre>
</body>
</html>
* Closing connection 0It's even weirder because the @application.hook('after_request')
def enable_cors():
response.headers['Access-Control-Allow-Origin'] = '*'
response.headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, OPTIONS'
response.headers['Access-Control-Allow-Headers'] = 'Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token'
print(response.headerlist)EDITIt does work in 0.13 |
Where is 0.13 available? I don't see any releases or tags or even a dev branch related to 0.13 in the repo |
|
That's the current master branch. |
Thank you! So |
|
Yes. There is no "dev" branch. |
|
Hello, |
|
@martinkirch even if 0.13 isn't release soon, you can definitely use the master branch in production. |
|
Cookie test is fixed now in The actual issue is still open for 0.12 I guess. |
|
Testing with 0.13.dev0 aka master branch, with python 2.7 (yes, we are migrating, but this is quite big) seems that headers set before the request (in a middleware via decorators, using response.add_header function) get deleted when using static_file. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This code runs properly. I'm able to get the headers when I make a request from another program. However if I change the route to
The hook gets run since I can see it in the server process log
but the header is not received in the program which made the call. That program is also quiet simple.
curl http://localhost:8080 -D-I saw #978 and was facing the same problem. Some of the UI frameworks using our APIs break if the error response does not have CORS headers.
Am I doing something wrong?
The text was updated successfully, but these errors were encountered: