adafruit / adafruit/Adafruit_CircuitPython_WSGI

Add in support for static asset file serving

Open
#6 1 comment 3 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
18
Forks
19
PR merge metrics
No merged PRs in 30d

Description

A very common use case for a web server is to be able to respond with static asset (files). This is primarily so that if a web browser makes an http request to your webserver, you can respond with a .html file which contains markup for a user interface. This `.html` file may also include references to other files, namely `.js` or .`css`, for front end javascript code and styling.

A common way to achieve this in other frameworks is to specify a particular folder on the server's filesystem, and expose white listed parts or all of its contents. I.e, If a http request comes in and matches the relative path of a file in that folder, then send back an 200 with the contents of that file.

This means that you wouldn't have to manually add a particular route for every static asset you want to serve, and less boiler plate code to read and transmit the asset.

------------
Using Flask as inspiration

#### Need at minimum
* WSGIApp class accepts a param called `static_folder` , that is the path to a folder on the local filesystem that should be served.
* WSGIApp class accepts a param called `static_url_path`, that is what the web app base path would be for serving files from `static_folder`. If not provided, default to serving with the same base path of `static_folder`
* expose a utility method for responding with a static folder that looks something like
`def send_from_directory(directory, filepath) -> return valid WSGI response`, for situations where you need to respond with a file but need to do it from your own route handler (simple example, serve this OR that file depending on some dynamic criteria)
* Like flask documents, only send_from_directory should be used if there is ANY client provided data being directly used, so that you do not permit read access to the entire filesystem; it must a filepath within a known directory.
* Do not expose a 'send_file' method for above reason, easy to shoot yourself in the foot.

#### Questions
* Do we default to automatically serving a folder named `static` at path `/static/` ?
* Most frameworks do this, but its worth posing the question
* Do we need some blacklisting regex that we apply be default?
* ex, disallow for serving `.py` or specifically `secrets.py`
* How do you opt out?
* Do we allow for configurable white listing or default white listing?
* ex. Only serve files in `/static` that are `.html`, `.css`, `.js`, photo types, etc ?
* Might not be necessary, as `/static/` is meant for purposefully adding files you want to serve, and would not usually have a file in there you do not want public.
* Would need appropriate warning documentation that this is the case.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the WSGIApp constructor and request-dispatch entry point. Review the proposed static_folder and static_url_path behavior, then define how send_from_directory safely limits client-provided paths. Done means static assets can be served, the utility supports dynamic routes, and the default, blacklist, whitelist, and warning-documentation questions have clear decisions.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, web-dev
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.