HTTP 308 Resume Incomplete missing in Zend\Http\Response about zendframework

[zfbot]

(Originally posted by: shevron on 02/08/12)

The right solution for this is that Zend\Http\Response (as well as Request and Client) should stop validating things like status codes, method names etc. using a white-list of possible values, and switch to using the rules specified in the HTTP RFC. The RFC does allow not only codes like 308 but basically any 3-digit custom status codes are allowed.

I am working to change these in my Zend\Http rewrite branch, but this branch also includes a host of other major changes so I do not consider it a fix for this bug, at least not until it is decided to fully merge this branch (if at all).

[zfbot]

This issue was ported from the ZF2 Jira Issue Tracker at
http://framework.zend.com/issues/browse/ZF2-156

Known GitHub users mentioned in the original message or comment:
@ralphschindler, @shevron

[jcrawford]

@shevron do you still plan to merge your rewrite branch? I notice above you said if at all. If you do not plan to merge the branch let me know and I can start looking into fixing this.

[shevron]

Sorry for the detaly. I am swamped at work in the forseeable future so I suggest that if you have a quick fix, fix it and don't wait for me. In any case my "fix" is a complete rewrite + BC breaks, so if we can fix it without that overhead, I think you should go for it.

[Maks3w]

@jcrawford @shevron Can you add a link to the RFC where this status code is defined?

[jcrawford]

@Maks3w I do not see it in the actual http rfc at all, they seem to stop at 307

[Maks3w]

Then I suggest add HTTP 308 to Zend\Http as a generic code

[gws]

http://tools.ietf.org/html/draft-reschke-http-status-308-07

The draft has expired, but Appendix A has some links to implementations.

[jcrawford]

@Maks3w @shevron @gwis I noticed the draft but it's not in the official RFC, should this be supported?

[shevron]

@jcrawford the real bug here is not the lack of a constant for each HTTP status code out there, but that Http\Response blows up and throws an exception for a code it doesn't know.

The HTTP standard is extinsible - it allows any status codes to be used in addition to the ones documented in the RFC (this also goes for request methods, headers, etc.), and Http* classes should be just as flexible. They should accept syntactically valid codes (the RFC defines what is syntactically valid) and deny invalid ones (e.g. a status code made out of letters) but not blow up on a syntactically valid status code it does not know.

I would have fixed this myself, but I am really struggling with free time recently. If that's something you can patch, I think it would be great. Even better if we remove all the places where Zend\Http* classes throw an exception for a code / header / method / etc. it doesn't know, as long as the protocol allows it.

[jcrawford]

@shevron thanks for the clarification I will see if I can get a fix submitted over the next few days.

[ralphschindler]

Does anyone want to produce a pull request for non-standard/extension http codes? If not, I suggest we close this as its a non-trival feature request.