DioxusLabs / DioxusLabs/dioxus

Fullstack endpoint ByteStream response replaced by referer page data for a download link

Open
#5,445 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Rust
Stars
39.1k
Forks
1.9k
Avg merge
4d 10h
Merged PRs (30d)
4

Description

**Problem**

When a request has a `Referer` header and `Accepts: text/html`, `make_handler` transforms the response into a 302/FOUND with a Location: .

`packages/fullstack-server/src/serverfn.rs:`
```rust
// if it accepts text/html (i.e., is a plain form post) and doesn't already have a
// Location set, then redirect to Referer
if accepts_html {
if let Some(referrer) = referrer {
let has_location = response.headers().get(LOCATION).is_some();
if !has_location {
*response.status_mut() = StatusCode::FOUND;
response.headers_mut().insert(LOCATION, referrer);
}
}
}
```

This causes a conflict with fullstack endpoints that return a `ByteStream`. If one creates a

```html
link
```

to download some binary content, clicking that link will download the referer page instead of the data of the ByteStream.

**Steps To Reproduce**

Steps to reproduce the behavior:

- create fullstack endpoint returning ByteStream
- create html anchor with href to the api
- clicking the link downloads the current page, logs indicate a status code 302
- right-clicking and "save as / download linked file" downloads the expected data!, logs indicate a status code 200

**Expected behavior**

The file returned by the ByteStream should be received/saved on click.

**Screenshots**

**Environment:**

- Dioxus version: 0.7.4
- Rust version: 1.94.1
- OS info: macOS
- App platform: web

**Questionnaire**

I would like to fix and I have a solution.

I see a few possible fixes, not sure which is best:

- remove that code in make_handler (it is probably there for a good reason though, but the commit (5559e463c8) does not explain why this was needed. Do you remember @jkelleyrtp ?)
- add a dummy `Location` header in ByteStream into_request so that we don't redirect (I did that manually in my web app)
- add an additional check in make_handler to prevent this happening in case of a Content-Type != text/html
- something else?

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.