[Django] #37232: Add support for the HTTP QUERY method (RFC 10008)

[Django]

#37232: Add support for the HTTP QUERY method (RFC 10008)
-------------------------------------+-------------------------------------
Reporter: Jonathan Biemond | Type: New
| feature
Status: new | Component: HTTP
| handling
Version: dev | Severity: Normal
Keywords: http query method | Triage Stage:
core request csrf generic views | Unreviewed
cache |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 1
-------------------------------------+-------------------------------------
Implement the [https://www.rfc-editor.org/rfc/rfc10008.html RFC
specification for the new HTTP QUERY method] in Django, that developers
may use to handle request content (A.K.A. request body) in a safe and
idempotent manner.
Thanks to JaeHyuckSa for writing the [https://github.com/django/new-
features/issues/185 proposal in the new features repo]. It highlights why
supporting the QUERY method would be useful to Django and shows community
support.

Once a search or filtering endpoint gets complex, GET and POST both
start to feel like awkward fits. The query string can become hard to work
with because of length limits, no universally agreed way to encode lists
or nested structures, and the risk of parameters ending up in logs. In
practice, people often fall back to POST, even though the request is still
only reading data and does not modify state. QUERY seems designed to
address exactly this gap: it keeps the safe and idempotent semantics of a
read request, while allowing the query to be sent in the request body.

=== Implementation
To summarize the specification, the implementation should include the
following:
* Treat the QUERY method as safe and idempotent.
* Handle conditional request the same as for the GET method.
* Caching support for the QUERY method and incorporate request content in
the cache key.

Further details include:
* Expose request content to the developer in `HttpRequest`.
* Exclude QUERY requests from CSRF checks.
* A `query()` method on the sync/async test clients.
* Allow for QUERY request handlers in generic views.
* Allow QUERY requests to views decorated with `@require_safe`.
* Ensure QUERY requests are not redirected by the `APPEND_SLASH` setting
in `CommonMiddleware`.

=== Design decisions
The details of the implementation raise numerous questions on how Django
will handle the new QUERY method. Especially since it is currently not
supported by any browsers. Django makes a very clear distinction in how it
handles GET/POST requests, from non-browser supported methods, such as
PATCH or DELETE.

==== How should Django handle the content of a QUERY request?
Currently, only the POST method populates `HttpRequest.POST`. While
content from methods not supported by browsers, like PUT, must be handled
explicitly be the developer.

==== How should the test client construct a QUERY request?
The [https://www.rfc-editor.org/rfc/rfc10008.html#name-examples examples
in the RFC] primarily use "application/x-www-form-urlencoded" as the
content type. Currently the test client uses "application/octet-stream"
for non-browser supported methods, like PUT, and "multipart/form-data" for
a POST request.

==== How should the `cache_key` incorporate request content?
To cache distinct QUERY requests, the `request.body` must be included in
the cache key.

==== May a cached QUERY response be used for a HEAD request?
Currently Django will utilize the cached response of a ''GET'' request for
a HEAD request to the same URL.
--
Ticket URL: <https://code.djangoproject.com/ticket/37232>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#37232: Add support for the HTTP QUERY method (RFC 10008)
-------------------------------------+-------------------------------------

Reporter: Jonathan Biemond | Owner: (none)

Type: New feature | Status: new
Component: HTTP handling | Version: dev

Severity: Normal | Resolution:

Keywords: http query method | Triage Stage:
core request csrf generic views | Unreviewed
cache |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 1
-------------------------------------+-------------------------------------

Comment (by Jonathan Biemond):

As much as I'd like to see QUERY method content populate
`HttpRequest.POST`, until browsers add support, I suspect the pragmatic
approach is to treat it the same as the other non-browser-supporting
content-bearing HTTP methods. In that case the content should probably be
left to `HttpRequest.body` where developers can parse it as they need.

May a cached QUERY response be used for a HEAD request?

Even if this is a valid thing to do, which I'm not able to figure out if
it is, I think it would be more trouble than it's worth. A QUERY request
would include content, and therefore has a very different cache key from a

HEAD request to the same URL.

I'll also note, I've put together a reference implementation, which might
be helpful to see how these different decisions play out in the code.
https://github.com/django/django/compare/main...jonbiemond:django:query-
method
--
Ticket URL: <https://code.djangoproject.com/ticket/37232#comment:1>

[Django]

#37232: Add support for the HTTP QUERY method (RFC 10008)
-------------------------------------+-------------------------------------
Reporter: Jonathan Biemond | Owner: (none)
Type: New feature | Status: new
Component: HTTP handling | Version: dev
Severity: Normal | Resolution:

Keywords: http query method | Triage Stage: Accepted

core request csrf generic views |

cache |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 1
-------------------------------------+-------------------------------------

Changes (by David Smith):

* stage: Unreviewed => Accepted

Comment:

Accepting, following the feature being moved forward on the new features
board. See [https://github.com/django/new-
features/issues/185#issuecomment-5059178679 comment].
--
Ticket URL: <https://code.djangoproject.com/ticket/37232#comment:2>

[Django]

#37232: Add support for the HTTP QUERY method (RFC 10008)
-------------------------------------+-------------------------------------

Reporter: Jonathan Biemond | Owner: 송준호
Type: New feature | Status: assigned

Component: HTTP handling | Version: dev
Severity: Normal | Resolution:
Keywords: http query method | Triage Stage: Accepted
core request csrf generic views |
cache |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 1
-------------------------------------+-------------------------------------

Changes (by 송준호):

* owner: (none) => 송준호
* status: new => assigned

--
Ticket URL: <https://code.djangoproject.com/ticket/37232#comment:3>

[Django]

#37232: Add support for the HTTP QUERY method (RFC 10008)
-------------------------------------+-------------------------------------
Reporter: Jonathan Biemond | Owner: 송준호
Type: New feature | Status: assigned
Component: HTTP handling | Version: dev
Severity: Normal | Resolution:
Keywords: http query method | Triage Stage: Accepted
core request csrf generic views |
cache |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 1
-------------------------------------+-------------------------------------

Changes (by Adam Johnson):

* cc: Adam Johnson (added)

--
Ticket URL: <https://code.djangoproject.com/ticket/37232#comment:4>

[Django]

#37232: Add support for the HTTP QUERY method (RFC 10008)
-------------------------------------+-------------------------------------
Reporter: Jonathan Biemond | Owner: 송준호
Type: New feature | Status: assigned
Component: HTTP handling | Version: dev
Severity: Normal | Resolution:
Keywords: http query method | Triage Stage: Accepted
core request csrf generic views |
cache |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 1
-------------------------------------+-------------------------------------

Comment (by Jonathan Biemond):

I'd like to summarize some out-of-ticket discussion regarding the
`HttpRequest` attribute Django should populate with QUERY request content.

One suggestion is to add a new `QUERY` attribute. There is also
[https://github.com/django/deps/pull/88 DEP 17 for Content Type Parsing]
which proposes adding lowercase attribute names to use instead of the
existing uppercase attributes.

With that in mind, I think the content from a QUERY request should be
accessed and parsed from `HttpRequest.body`. And I hope that DEP 17 will
one day add a more convenient way for accessing automatically parsed
content from a QUERY request. Using `request.body`, as opposed to a new
attribute, means less migration work for the DEP.
--
Ticket URL: <https://code.djangoproject.com/ticket/37232#comment:5>

[Django]

#37232: Add support for the HTTP QUERY method (RFC 10008)
-------------------------------------+-------------------------------------
Reporter: Jonathan Biemond | Owner: 송준호
Type: New feature | Status: assigned
Component: HTTP handling | Version: dev
Severity: Normal | Resolution:
Keywords: http query method | Triage Stage: Accepted
core request csrf generic views |
cache |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 1
-------------------------------------+-------------------------------------

Changes (by Dan LaManna):

* cc: Dan LaManna (added)

--
Ticket URL: <https://code.djangoproject.com/ticket/37232#comment:6>

[Django]

#37232: Add support for the HTTP QUERY method (RFC 10008)
-------------------------------------+-------------------------------------
Reporter: Jonathan Biemond | Owner: 송준호
Type: New feature | Status: assigned
Component: HTTP handling | Version: dev
Severity: Normal | Resolution:
Keywords: http query method | Triage Stage: Accepted
core request csrf generic views |
cache |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 1
-------------------------------------+-------------------------------------

Changes (by Ben Atkinson):

* cc: Ben Atkinson (added)

--
Ticket URL: <https://code.djangoproject.com/ticket/37232#comment:7>

[Django]

#37232: Add support for the HTTP QUERY method (RFC 10008)
-------------------------------------+-------------------------------------
Reporter: Jonathan Biemond | Owner: 송준호
Type: New feature | Status: assigned
Component: HTTP handling | Version: dev
Severity: Normal | Resolution:
Keywords: http query method | Triage Stage: Accepted
core request csrf generic views |
cache |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 1
-------------------------------------+-------------------------------------

Comment (by Michiel Beijen):

I've opened a PR with an implementation of the method itself at
https://github.com/django/django/pull/21855, leaving caching for a follow-
up since the cache key needs to incorporate the request content.

송준호, I noticed you took this on. If you have work in progress, let me
know and I'll close my pull request and review yours instead. I've left
the ticket assigned to you.
--
Ticket URL: <https://code.djangoproject.com/ticket/37232#comment:8>

[Django]

#37232: Add support for the HTTP QUERY method (RFC 10008)
-------------------------------------+-------------------------------------
Reporter: Jonathan Biemond | Owner: 송준호
Type: New feature | Status: assigned
Component: HTTP handling | Version: dev
Severity: Normal | Resolution:
Keywords: http query method | Triage Stage: Accepted
core request csrf generic views |
cache |

Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 1
-------------------------------------+-------------------------------------

Changes (by Michiel Beijen):

* cc: Michiel Beijen (added)
* has_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/37232#comment:9>