在 App Engine 上使用 Django 处理 HTTP HEAD 请求的最佳实践
我在我的应用程序中收到 HEAD 请求，并想知道处理它们的最佳方法。选项是：
- 将它们转换为 GET，正常处理 GET，然后：
- 剥离主体（尽管我不确定如何 -
response.content = ''似乎没有做到这一点。 - 应用引擎似乎会自动剥离正文，并发出警告“响应 HEAD 请求而丢弃意外的正文”
- 剥离主体（尽管我不确定如何 -
看起来这很干净，并且可以使用装饰器或中间件来很好地编写
- 专门处理每个 HEAD 请求：
- 这意味着我可以在某些（很多？）情况下避免数据存储访问。
- 显然存在这样的风险：这种方法将阻止设置 Content-length 标头的中间件这样做。
还要别的吗？我应该做什么？使用 App Engine 会有什么不同吗？有没有微妙的细节；如果是的话，是否有合适的中间件可以使用？要转换为 GET，`request.method = "GET" 是否足够（似乎有效）？
I'm receiving HEAD requests in my application, and wondering on the best way to handle them. Options are:
- convert them to GETs, process GET normally, then:
- strip the body (though I'm not sure how -
response.content = ''doesn't seem to do it. - it seems app engine auto-strips the body, giving a warning "Dropping unexpected body in response to HEAD request"
- strip the body (though I'm not sure how -
It seems this is clean, and can be written nicely using decorators or middleware.
- Handle each HEAD request specially:
- this means I could avoid a DataStore access in some (many?) cases.
- There is a risk, apparently, that middleware which sets the Content-length header will be prevented from doing so by this approach.
Anything else? Which should I do? Does using App Engine make a difference here? Are there subtle details; if so, is there appropriate middleware to use? To convert to GET, is `request.method = "GET" sufficient (it seems to work)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您是否打算让您的应用程序处理 HEAD 请求，或者这些请求是否来自某个匿名来源？您当然没有义务满足 HEAD 请求。您可以仅返回状态代码 405（不允许的方法），并使用 GET 或任何您想要处理的内容提供允许标头。
我认为手动将 request.method 设置为 GET 没有意义；很有可能，您只是返回一个比请求者想要的更大的响应。他们只是想查看响应的标题。如果您不想处理 HEAD，请执行 405 和允许标头方法。
一般来说，客户端发送 HEAD 请求是因为他们试图明智地在不需要时不处理完整的响应。他们正在检查 Content-Length 自上次看到响应以来是否已更改，或者他们希望查看 Last-Modified 或 Expires 标头。
对于您的应用程序来说，优雅地处理 HEAD 请求当然是行为良好的，但您不必这样做。
Did you intend for you application to handle HEAD requests, or are these coming from some anonymous source? You certainly aren't obligated to honor a HEAD request. You can just return with a status code of 405 (Method not allowed) and provide the Allow header with GET or whatever you mean to handle.
I don't think that manually setting request.method to GET is meaningful; in all probability, you are just returning a response that is larger than what the requester wanted. They just wanted to see the headers for the response. If you don't want to handle the HEAD, do the 405 and Allow header approach.
Generally, a client sends a HEAD request because they are trying to be smart about not handling a full response if they don't need to. They are checking to see if the Content-Length has changed since the last time that they saw the response, or they want to see the Last-Modified or Expires header.
It is certainly well-behaved for your application to gracefully handle HEAD requests, but you don't have to.