DioxusLabs / DioxusLabs/dioxus
Fullstack endpoint ByteStream response replaced by referer page data for a download link
- Dominant language
- Rust
- Stars
- 39.1k
- Forks
- 1.9k
- Avg merge
- 4d 10h
- Merged PRs (30d)
- 4
Description
**Problem**
When a request has a `Referer` header and `Accepts: text/html`, `make_handler` transforms the response into a 302/FOUND with a Location: .
`packages/fullstack-server/src/serverfn.rs:`
```rust
// if it accepts text/html (i.e., is a plain form post) and doesn't already have a
// Location set, then redirect to Referer
if accepts_html {
if let Some(referrer) = referrer {
let has_location = response.headers().get(LOCATION).is_some();
if !has_location {
*response.status_mut() = StatusCode::FOUND;
response.headers_mut().insert(LOCATION, referrer);
}
}
}
```
This causes a conflict with fullstack endpoints that return a `ByteStream`. If one creates a
```html
link
```
to download some binary content, clicking that link will download the referer page instead of the data of the ByteStream.
**Steps To Reproduce**
Steps to reproduce the behavior:
- create fullstack endpoint returning ByteStream
- create html anchor with href to the api
- clicking the link downloads the current page, logs indicate a status code 302
- right-clicking and "save as / download linked file" downloads the expected data!, logs indicate a status code 200
**Expected behavior**
The file returned by the ByteStream should be received/saved on click.
**Screenshots**
**Environment:**
- Dioxus version: 0.7.4
- Rust version: 1.94.1
- OS info: macOS
- App platform: web
**Questionnaire**
I would like to fix and I have a solution.
I see a few possible fixes, not sure which is best:
- remove that code in make_handler (it is probably there for a good reason though, but the commit (5559e463c8) does not explain why this was needed. Do you remember @jkelleyrtp ?)
- add a dummy `Location` header in ByteStream into_request so that we don't redirect (I did that manually in my web app)
- add an additional check in make_handler to prevent this happening in case of a Content-Type != text/html
- something else?
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.