🌐 US-Proxy
class="logged-out env-production page-responsive" style="word-wrap: break-word;" >
Skip to content

"A status is a code" doesn't actually mean anything #1142

Closed

Description

@tabatkins

The definition of status simply states:

A status is a code.

It then follows up with some more specification definitions of particular types of statuses, which imply that by "code" you mean "an integer, probably somewhere in the range 1-1000 or so".

Since "code" doesn't have a definition, and the English definition doesn't generally map to "integer in some range", this dfn should instead actually specify what a status is: a positive (or non-negative?) integer, probably in some specified range.

Activity

  1. annevk commented on Jan 21, 2021

    @annevk
    Member

    Thanks, turns out this is a bit of a mess I had not previously looked into in detail (beyond 699, which has test coverage).

    • 0-99: these are returned as-is. Firefox returns 0 as 200. (Probably requires further testing between returning 1 and 001 server-side.)
    • 1xx: these are not returned to the caller and handled by fetch/HTTP directly. Generally by waiting for the final response.
    • 2xx-5xx: generally returned to the caller, specifics handled by Fetch already (if not, Fetch needs a patch).
    • 6xx-9xx: returned to the caller.
    • 1000+: Safari treats these as a network error. Chrome and Firefox keep trucking, but their maximum returned value is 65535 after which they start wrapping which feels like a security issue of sorts, e.g., 65736 is returned as 200 and 131072 as 0.

    (I agree that we should say this is a number by the way. For the purposes of Fetch I suspect we want at least the range 0-999 to be supported, but perhaps not 1-99, depending on whether user agents are willing to be stricter there.)

    cc @whatwg/http

    Bugs filed:

  2. added
    needs testsMoving the issue forward requires someone to write tests
    on Jan 21, 2021
  3. MattMenke2 commented on Jan 21, 2021

    @MattMenke2
    Contributor

    The fact that they're truncated to 16-bits in Chrome is weird - looking at the code, they're treated as signed 32-bit ints down through the top level of the render process code. That has its own issues, obviously - the int parser looks like it overflows/underflows to the max int/min int values, but seems better than the 16-bit overflow behavior described.

    Another "fun" behavior is that Chrome adds a 200 status code if there is no status code, but I guess that's should be treated as another issue entirely.

  4. shacharz commented on Jan 21, 2021

    @shacharz

    In my experience 3xx usually are not returned to the caller and handled by fetch/HTTP directly

  5. MattMenke2 commented on Jan 21, 2021

    @MattMenke2
    Contributor

    What about 3xx headers without a location header, or 3xx-es without an assigned meaning?

  6. annevk commented on Jan 21, 2021

    @annevk
    Member

    @MattMenke2 ah, I suspect the mapping from 32- to 16-bit happens at the IDL layer (status is unsigned short which is 16-bit). (And yeah, I didn't delve into 206, 3xx, and such here as we already have issues or they are already adequately tested. If I remember correctly 3xx without Location or assigned meaning are passed to the caller.)

  7. added a commit that references this issue on Feb 1, 2021
  8. annevk commented on Feb 1, 2021

    @annevk
    Member

    @tabatkins I think the ideal outcome here is a number in the range 0 to 999, inclusive. Do you need to look at this field for a specification? Note that we have "ok status" which is what specifications generally use if they need this.

  9. removed
    needs testsMoving the issue forward requires someone to write tests
    on Feb 1, 2021
  10. added 2 commits that reference this issue on Feb 1, 2021
    3853246
    a0ff025
  11. added a commit that references this issue on Feb 1, 2021
    cb8995b
  12. tabatkins commented on Feb 1, 2021

    @tabatkins
    ContributorAuthor

    Do you need to look at this field for a specification?

    No, I was just looking over Fetch for a different purpose, and happened to run across this and was like "hey, this isn't very good, huh".

  13. mikkorantalainen commented on Jun 2, 2024

    @mikkorantalainen

    The spec says A <dfn export>redirect status</dfn> is a <a for=/>status</a> that is 301, 302, 303, 307, or 308. – should it also mention that real world browsers do honor Location header for a redirect with any status code?

  14. annevk commented on Jun 3, 2024

    @annevk
    Member

    Not all browsers do that and that's considered a bug.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions