Path: csiph.com!usenet.pasdenom.info!news.etla.org!news.stack.nl!newsfeed.xs4all.nl!newsfeed2.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail Return-Path: X-Original-To: python-list@python.org Delivered-To: python-list@mail.python.org X-Spam-Status: OK 0.001 X-Spam-Evidence: '*H*': 1.00; '*S*': 0.00; ';-)': 0.03; 'causing': 0.04; 'receives': 0.04; 'app,': 0.09; 'cherrypy': 0.09; 'decorator': 0.09; "django's": 0.09; 'etc).': 0.09; 'http': 0.09; 'occasionally': 0.09; 'referenced': 0.09; 'subject:Cherrypy': 0.09; 'type,': 0.09; 'suggest': 0.14; 'anyway': 0.14; 'random': 0.14; '-tkc': 0.16; 'begging': 0.16; 'from:addr:python.list': 0.16; 'from:addr:tim.thechases.com': 0.16; 'from:name:tim chase': 0.16; 'landing': 0.16; 'merely': 0.16; 'accordingly.': 0.16; 'prevent': 0.16; 'wrote:': 0.18; 'server,': 0.19; 'machine': 0.22; 'css,': 0.24; 'headers': 0.24; 'sends': 0.24; 'header': 0.24; "haven't": 0.24; 'question': 0.24; 'performing': 0.26; 'header:In- Reply-To:1': 0.27; 'specifically': 0.29; 'rest': 0.29; '[1]': 0.29; 'thus': 0.29; 'matching': 0.30; "i'm": 0.30; 'page.': 0.31; 'serve': 0.31; '(although': 0.31; '(my': 0.31; 'header,': 0.31; 'running': 0.33; 'implemented': 0.33; "i'd": 0.34; 'could': 0.34; "can't": 0.35; 'something': 0.35; 'but': 0.35; 'there': 0.35; 'version': 0.36; 'charset:us-ascii': 0.36; 'received:10': 0.37; 'being': 0.38; 'actions': 0.38; 'apple': 0.38; 'question,': 0.38; 'handle': 0.38; 'to:addr:python-list': 0.38; 'that,': 0.38; 'recent': 0.39; 'ability': 0.39; 'to:addr:python.org': 0.39; 'enough': 0.39; 'how': 0.40; 'assets': 0.61; 'browser': 0.61; 'skip:n 10': 0.64; 'more': 0.64; 'laptop': 0.65; '10.4': 0.84; 'investigated': 0.84; 'ppc': 0.84; 'reading,': 0.84; 'bounce': 0.91; 'effects.': 0.91; 'trouble.': 0.91 X-Sender-Id: wwwh|x-authuser|tim@thechases.com X-Sender-Id: wwwh|x-authuser|tim@thechases.com X-MC-Relay: Neutral X-MailChannels-SenderId: wwwh|x-authuser|tim@thechases.com X-MailChannels-Auth-Id: wwwh X-MC-Loop-Signature: 1417469018684:241156566 X-MC-Ingress-Time: 1417469018683 Date: Mon, 1 Dec 2014 15:26:08 -0600 From: Tim Chase To: python-list@python.org Subject: Re: Cherrypy - prevent browser "prefetch"? In-Reply-To: <6B74D6DD-A597-4BCF-8586-D0A56C9CDB77@ravnalaska.net> References: <6B74D6DD-A597-4BCF-8586-D0A56C9CDB77@ravnalaska.net> X-Mailer: Claws Mail 3.8.1 (GTK+ 2.24.10; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-AuthUser: tim@thechases.com X-BeenThere: python-list@python.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: General discussion list for the Python programming language List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Newsgroups: comp.lang.python Message-ID: Lines: 46 NNTP-Posting-Host: 2001:888:2000:d::a6 X-Trace: 1417469029 news.xs4all.nl 2865 [2001:888:2000:d::a6]:46696 X-Complaints-To: abuse@xs4all.nl Xref: csiph.com comp.lang.python:81777 On 2014-12-01 11:28, Israel Brewster wrote: > I don't know if this is a cherrypy specific question (although it > will be implemented in cherrypy for sure), or more of a general > http protocol question, but when using cherrypy to serve a web app, > is there anyway to prevent browser prefetch? I'm running to a > problem, specifically from Safari on the Mac, where I start to type > a URL, and Safari auto-fills the rest of a random URL matching what > I started to type, and simultaneously sends a request for that URL > to my server, occasionally causing unwanted effects. This SO post[1] suggests that Firefox sets/sends a X-moz: prefetch header, while Safari and Chrome use the X-Purpose: preview header. You could create a decorator that sniffs those headers and reacts accordingly. Though be aware that, based on my reading, Safari only sends that X-Purpose header for the base page, not any referenced assets (JS, CSS, images, etc). Also, while I can't find any documentation on how Safari/Chrome(ium) handle it, if your logout/ page sends an HTTP/302 redirect to a final landing page, Safari/Chrome(ium) may be smart enough to not suggest (and thus not prefetch) the bounce page, only the landing page. I haven't investigated recently, but I remember Django's ability to trigger a log-out merely via a GET was something that irked me. I don't have a recent version of Safari (my only Apple machine is a PPC iBook laptop running 10.4 which no longer receives any updates) so I can't verify that this header is actually being sent in the case you describe, but it would be where I'd start hunting. All this to also say that performing non-idempotent actions on a GET request is just begging for trouble. ;-) -tkc [1] http://stackoverflow.com/questions/9852257/http-header-to-detect-a-preload-request-by-google-chrome