haskell-servant / haskell-servant/servant

API construction is too lenient

Open
#659 6 comments 0 reactions 0 assignees View on GitHub
help wanted
Dominant language
Haskell
Stars
2k
Forks
427
Avg merge
2d 23h
Merged PRs (30d)
5

Description

All of the following compile, but produce code which is nonsense in practice:

- Static path parts containing slashes:
```haskell
"api/v1/item" :> Get '[JSON] [Item]
```
This should be done as `"api" :> "v1" :> "item" :> ...`, and the resulting API is not functional.

- Case-sensitive headers:
```haskell
Header "Authentication" String :> Header "authentication" String :> "item" :> Get '[JSON] [Item]
```
According to the [RFC](https://tools.ietf.org/html/rfc7230#section-3.2), header names are case sensitive. Servant already handles this correctly by assigning the same value to both if either is set, but allowing both to be defined could theoretically result in hard-to-find bugs, as a client _can_ send both at the same time.

- Duplicate headers:
```haskell
Header "authentication" String :> Header "authentication" String :> "item" :> Get '[JSON] [Item]
```
Obviously, the resulting server will be passed two identical values. This should not be allowed, as some external code which parses this may rely on the uniqueness of headers.

I'm not sure if it's even technically possible to prevent those from compiling, but it would be nice to have.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.