Opened 19 months ago

Closed 19 months ago

Last modified 19 months ago

#34519 closed Bug (duplicate)

Don't send content in responses to HEAD requests

Reported by: James Pic Owned by: nobody
Component: Uncategorized Version: 4.2
Severity: Normal Keywords:
Cc: Triage Stage: Unreviewed
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: yes UI/UX: no

Description (last modified by James Pic)

Responses to HEAD requests must not send content as per RFC9110

9.3.2. HEAD
The HEAD method is identical to GET except that the server MUST NOT send content in the response.

https://www.rfc-editor.org/rfc/rfc9110.html#name-head

Currently, Django sends content in response to HEAD requests.

Django *MUST NOT* send content in response for HEAD requests.

Demonstration:

$ django-admin startproject test
$ cd test && ./manage.py runserver
# tcpdump -vv -s0 -A -i lo port 8000 &> tcpdump.txt
$ curl -I localhost:8000

tcpdump.txt attached, it shows Django sends content in the HEAD response

Attachments (1)

tcpdump.txt (15.9 KB ) - added by James Pic 19 months ago.

Download all attachments as: .zip

Change History (9)

comment:1 by James Pic, 19 months ago

Summary: HEAD responses must not return any contentDon't send content in responses to HEAD requests

comment:2 by David Sanders, 19 months ago

Resolution: needsinfo
Status: newclosed

Thanks for the report but it's not clear what issue you are reporting with Django. Feel free to update the ticket with more context; closing for now pending more information.

comment:3 by James Pic, 19 months ago

Do you want a description like this?

Currently, Django sends content in responses to HEAD requests.
Django MUST NOT send content in responses to HEAD requests, as per RFC9110;
The HEAD method is identical to GET except that the server MUST NOT send content in the response.
https://www.rfc-editor.org/rfc/rfc9110.html#name-head

Is that better or do you think we need more?

by James Pic, 19 months ago

Attachment: tcpdump.txt added

comment:4 by James Pic, 19 months ago

Description: modified (diff)

comment:5 by James Pic, 19 months ago

Updated the description, I think it's now pretty understandable even with little understanding of Django and HTTP ;)

comment:6 by James Pic, 19 months ago

Easy pickings: set

comment:7 by Mariusz Felisiak, 19 months ago

Resolution: needsinfoduplicate

comment:8 by James Pic, 19 months ago

Thanks you very much!

Note: See TracTickets for help on using tickets.
Back to Top