Subject: Weak ETag handling

From: Lisa Dusseault <[email-masked]>
Date: Tue, 3 Feb 2009 10:22:46 -0800

I know I've ranted about this before, but just ran across it in code again
today:

        etag.weak = (value[:2] == "W/")

        if etag.weak:
            etag.tag = value[2:]
        else:
            etag.tag = value

Stripping the "W/" off a weak etag to get a strong one, because it works
with Apache.

This bothers me to an unreasonable extent.  Is there nothing we can do about
this?  Redefine the standard to match practice?  Clarify the standard to
condemn this practice?

Lisa

---

From: David Morris <[email-masked]>
Date: Tue, 3 Feb 2009 11:09:38 -0800 (PST)

> Stripping the "W/" off a weak etag to get a strong one, because it works

Actually, from this piece of code, we can't tell if 'weak' is ignored 
since the flag 'etag.weak' will retain the weak status. This may just
be related to making other comparisons easier?

Dave Morris

---

From: "Roy T. Fielding" <[email-masked]>
Date: Tue, 3 Feb 2009 11:17:57 -0800

On Feb 3, 2009, at 10:22 AM, Lisa Dusseault wrote:
> I know I've ranted about this before, but just ran across it in  
> code again today:
>
> Stripping the "W/" off a weak etag to get a strong one, because it  
> works with Apache.
>
> This bothers me to an unreasonable extent.  Is there nothing we can  
> do about this?  Redefine the standard to match practice?  Clarify  
> the standard to condemn this practice?

It is hard to have the standard specify restrictions on nonstandard
behavior (assuming that etag.week is not being used later to modify
its behavior).  At best we could clarify all the reasons that a tag
might be called weak and explain the risks of ignoring that weakness.

....Roy

---

From: Jamie Lokier <[email-masked]>
Date: Wed, 4 Feb 2009 12:33:32 +0000

Lisa Dusseault wrote:
> Stripping the "W/" off a weak etag to get a strong one, because it works with
> Apache.

But it doesn't work with Apache.  Apache issues a weak etag when file
contents can change without the weak etag changing.

Ergo, the Python code doesn't work with Apache, unless it's making
additional assumptions about specific server behaviour - not just
Apache, but the application which updates files served by Apache.

The Python code is clearly specific to a particular server application
- or most likely buggy.  If it's specific to a server application, it
can assume anything it likes about the meaning of weak etags.

-- Jamie