haskell-servant / haskell-servant/servant
API construction is too lenient
- Dominant language
- Haskell
- Stars
- 2k
- Forks
- 427
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 5
Description
All of the following compile, but produce code which is nonsense in practice:
- Static path parts containing slashes:
```haskell
"api/v1/item" :> Get '[JSON] [Item]
```
This should be done as `"api" :> "v1" :> "item" :> ...`, and the resulting API is not functional.
- Case-sensitive headers:
```haskell
Header "Authentication" String :> Header "authentication" String :> "item" :> Get '[JSON] [Item]
```
According to the [RFC](https://tools.ietf.org/html/rfc7230#section-3.2), header names are case sensitive. Servant already handles this correctly by assigning the same value to both if either is set, but allowing both to be defined could theoretically result in hard-to-find bugs, as a client _can_ send both at the same time.
- Duplicate headers:
```haskell
Header "authentication" String :> Header "authentication" String :> "item" :> Get '[JSON] [Item]
```
Obviously, the resulting server will be passed two identical values. This should not be allowed, as some external code which parses this may rely on the uniqueness of headers.
I'm not sure if it's even technically possible to prevent those from compiling, but it would be nice to have.
Contributor guide
Assessment
This issue has not been assessed yet.