WebOb Change History¶
1.8.8 (2024-08-13)¶
Security Fix¶
- The use of WebOb's Response object to redirect a request to a new location can lead to an open redirect if the Location header is not a full URI. - See https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3 and CVE-2024-42353 - Thanks to Sara Gao for the report 
1.8.7 (2021-02-17)¶
Bugfix¶
- Decoding deflate-encoded responses now supports data which is packed in a zlib container as it is supposed to be. The old, non-standard behaviour is still supported. 
1.8.6 (2020-01-21)¶
Experimental Features¶
- The SameSite value now includes a new option named "None", this is a new change that was introduced in https://tools.ietf.org/html/draft-west-cookie-incrementalism-00 - Please be aware that older clients are incompatible with this change: https://www.chromium.org/updates/same-site/incompatible-clients, WebOb does not enable SameSite on cookies by default, so there is no backwards incompatible change here. 
- Validation of SameSite values can be disabled by toggling a module flag. This is in anticipation of future changes in evolving cookie standards. The discussion in https://github.com/Pylons/webob/pull/407 (which initially expanded the allowed options) notes the sudden change to browser cookie implementation details may happen again. - In May 2019, Google announced a new model for privacy controls in their browsers, which affected the list of valid options for the SameSite attribute of cookies. In late 2019, the company began to roll out these changes to their browsers to force developer adoption of the new specification. See https://www.chromium.org/updates/same-site and https://blog.chromium.org/2019/10/developers-get-ready-for-new.html for more details on this change. 
1.8.5 (2019-01-03)¶
Warnings¶
- Fixed one last remaining invalid escape sequence in a docstring. 
1.8.4 (2018-11-11)¶
Bugfix¶
- Response.content_type now accepts unicode strings on Python 2 and encodes them to latin-1. See https://github.com/Pylons/webob/pull/389 and https://github.com/Pylons/webob/issues/388 
- Accept header classes now support a .copy() function that may be used to create a copy. This allows - create_accept_headerand other like functions to accept an pre-existing Accept header. See https://github.com/Pylons/webob/pull/386 and https://github.com/Pylons/webob/issues/385
Warnings¶
- Some backslashes introduced with the new accept handling code were causing DeprecationWarnings upon compiling the source to pyc files, all of the backslashes have been reigned in as appropriate, and users should no longer see DeprecationWarnings for invalid escape sequence. See https://github.com/Pylons/webob/issues/384 
1.8.3 (2018-10-14)¶
Bugfix¶
- acceptparse.AcceptValidHeader,- acceptparse.AcceptInvalidHeader, and- acceptparse.AcceptNoHeaderwill now always ignore offers that do not match the required media type grammar when calling- .acceptable_offers(). Previous versions raised a- ValueErrorfor invalid offers in- AcceptValidHeaderand returned them as acceptable in the others. See https://github.com/Pylons/webob/pull/372
Feature¶
- Add Request.remote_host, exposing REMOTE_HOST environment variable. 
- Added - acceptparse.Accept.parse_offerto codify what types of offers are compatible with- acceptparse.AcceptValidHeader.acceptable_offers,- acceptparse.AcceptMissingHeader.acceptable_offers, and- acceptparse.AcceptInvalidHeader.acceptable_offers. This API also normalizes the offer with lowercased type/subtype and parameter names. See https://github.com/Pylons/webob/pull/376 and https://github.com/Pylons/webob/pull/379
1.8.2 (2018-06-05)¶
Bugfix¶
- SameSite may now be passed as str or bytes to Response.set_cookie and cookies.make_cookie. This was an oversight as all other arguments would be correctly coerced before being serialized. See https://github.com/Pylons/webob/issues/361 and https://github.com/Pylons/webob/pull/362 
1.8.1 (2018-04-10)¶
Bugfix¶
- acceptparse.MIMEAccept which is deprecated in WebOb 1.8.0 made a backwards incompatible change that led to it raising on an invalid Accept header. This behaviour has now been reversed, as well as some other fixes to allow MIMEAccept to behave more like the old version. See https://github.com/Pylons/webob/pull/356 
1.8.0 (2018-04-04)¶
Feature¶
- request.POSTnow supports any requests with the appropriate Content-Type. Allowing any HTTP method to access form encoded content, including DELETE, PUT, and others. See https://github.com/Pylons/webob/pull/352
Compatibility¶
- WebOb is no longer officially supported on Python 3.3 which was EOL'ed on 2017-09-29. 
Backwards Incompatibilities¶
- Many changes have been made to the way WebOb does Accept handling, not just for the Accept header itself, but also for Accept-Charset, Accept-Encoding and Accept-Language. This was a Google Summer of Code project completed by Whiteroses (https://github.com/whiteroses). Many thanks to Google for running GSoC, the Python Software Foundation for organising and a huge thanks to Ira for completing the work. See https://github.com/Pylons/webob/pull/338 and https://github.com/Pylons/webob/pull/335. Documentation is available at https://docs.pylonsproject.org/projects/webob/en/master/api/webob.html 
- When calling a - @wsgifydecorated function, the default arguments passed to- @wsgifyare now used when called with the request, and not as a start_response- def hello(req, name): return "Hello, %s!" % name app = wsgify(hello, args=("Fred",)) req = Request.blank('/') resp = req.get_response(app) # => "Hello, Fred" resp2 = app(req) # => "Hello, Fred" - Previously the - resp2line would have failed with a- TypeError. With this change there is no way to override the default arguments with no arguments. See https://github.com/Pylons/webob/pull/203
- When setting - app_iteron a- Responseobject the- content_md5header is no longer cleared. This behaviour is odd and disallows setting the- content_md5and then returning an iterator for chunked content encoded responses. See https://github.com/Pylons/webob/issues/86
Experimental Features¶
These features are experimental and may change at any point in the future.
- The cookie APIs now have the ability to set the SameSite attribute on a cookie in both - webob.cookies.make_cookieand- webob.cookies.CookieProfile. See https://github.com/Pylons/webob/pull/255
Bugfix¶
- Exceptions now use string.Template.safe_substitute rather than string.Template.substitute. The latter would raise for missing mappings, the former will simply not substitute the missing variable. This is safer in case the WSGI environ does not contain the keys necessary for the body template. See https://github.com/Pylons/webob/issues/345. 
- Request.host_url, Request.host_port, Request.domain correctly parse IPv6 Host headers as provided by a browser. See https://github.com/Pylons/webob/pull/332 
- Request.authorization would raise ValueError for unusual or malformed header values. See https://github.com/Pylons/webob/issues/231 
- Allow unnamed fields in form data to be properly transcoded when calling request.decode with an alternate encoding. See https://github.com/Pylons/webob/pull/309 
- Response.__init__would discard- app_iterwhen a- Responsehad no body, this would cause issues when- app_iterwas an object that was tied to the life-cycle of a web application and had to be properly closed.- app_iteris more advanced API for- Responseand thus even if it contains a body and is thus against the HTTP RFC's, we should let the users shoot themselves by returning a body. See https://github.com/Pylons/webob/issues/305
1.7rc1 (2016-11-18)¶
Compatibility¶
- WebOb is no longer supported on Python 2.6 and PyPy3 (due to pip no longer supporting Python 3.2 even on PyPy) 
Backwards Incompatibility¶
- Response.set_cookieno longer accepts a key argument. This was deprecated in WebOb 1.5 and as mentioned in the deprecation, is being removed in 1.7
- Response.__init__will no longer set the default Content-Type, nor Content-Length on Responses that don't have a body. This allows WebOb to return proper responses for things like Response(status='204 No Content').
- Response.textwill no longer raise if the Content-Type does not have a charset, it will fall back to using the new- default_body_encoding`. To get the old behaviour back please sub-class ``Responseand set- default_body_encodingto- None. See https://github.com/Pylons/webob/pull/287
- WebOb no longer supports Chunked Encoding, this means that if you are using WebOb and need Chunked Encoding you will be required to have a proxy that unchunks the request for you. Please read https://github.com/Pylons/webob/issues/279 for more background. 
Feature¶
- Responsehas a new- default_body_encodingwhich may be used to allow getting/setting- Response.textwhen a Content-Type has no charset. See https://github.com/Pylons/webob/pull/287
- webob.Requestwith any HTTP method is now allowed to have a body. This allows DELETE to have a request body for passing extra information. See https://github.com/Pylons/webob/pull/283 and https://github.com/Pylons/webob/pull/274
- Add - tell()to- ResponseBodyFileso that it may be used for example for zipfile support. See https://github.com/Pylons/webob/pull/117
- Allow the return from - wsgify.middlewareto be used as a decorator. See https://github.com/Pylons/webob/pull/228
Bugfix¶
- Fixup - cgi.FieldStorageon Python 3.x to work-around issue reported in Python bug report 27777 and 24764. This is currently applied for Python versions less than 3.7. See https://github.com/Pylons/webob/pull/294
- Response.set_cookienow accepts- datetimeobjects for the- expireskwarg and will correctly convert them to UTC with no tzinfo for use in calculating the- max_age. See https://github.com/Pylons/webob/issues/254 and https://github.com/Pylons/webob/pull/292
- Fixes - request.PATH_SAFEto contain all of the path safe characters according to RFC3986. See https://github.com/Pylons/webob/pull/291
- WebOb's exceptions will lazily read underlying variables when inserted into templates to avoid expensive computations/crashes when inserting into the template. This had a bad performance regression on Py27 because of the way the lazified class was created and returned. See https://github.com/Pylons/webob/pull/284 
- wsgify.__call__raised a- TypeErrorwith an unhelpful message, it will now return the- reprfor the wrapped function: https://github.com/Pylons/webob/issues/119
- Response.content_typeremoves the charset content-type parameter unless the new content-type is a text like type that has a charset parameter. See https://github.com/Pylons/webob/pull/261 and https://github.com/Pylons/webob/issues/130
- Response.json's- json.dumps/- json.loadsare now always UTF-8. It no longer tries to use the charset.
- The - Response.__init__will by default no longer set the Content-Type to the default if a- headerlistis provided. This fixes issues whereby- Request.get_response()would return a Response that didn't match the actual response. See https://github.com/Pylons/webob/pull/261 and https://github.com/Pylons/webob/issues/205
- Cleans up the remainder of the issues with the updated WebOb exceptions that were taught to return JSON in version 1.6. See https://github.com/Pylons/webob/issues/237 and https://github.com/Pylons/webob/issues/236 
- Response.from_filenow parses the status line correctly when the status line contains an HTTP with version, as well as a status text that contains multiple white spaces (e.g HTTP/1.1 404 Not Found). See https://github.com/Pylons/webob/issues/250
- Responsenow has a new property named- has_bodythat may be used to interrogate the- Responseto find out if- Response.bodyis or isn't set.- This is used in the exception handling code so that if you use a WebOb HTTP Exception and pass a generator to - app_iterWebOb won't attempt to read the whole thing and instead allows it to be returned to the WSGI server. See https://github.com/Pylons/webob/pull/259
1.6.0 (2016-03-15)¶
Compatibility¶
- Python 3.2 is no longer supported by WebOb 
Bugfix¶
- Request.decode attempted to read from the an already consumed stream, it has now been redirected to another stream to read from. See https://github.com/Pylons/webob/pull/183 
- The application/json media type does not allow for a charset as discovery of the encoding is done at the JSON layer. Upon initialization of a Response WebOb will no longer add a charset if the content-type is set to JSON. See https://github.com/Pylons/webob/pull/197 and https://github.com/Pylons/pyramid/issues/1611 
Features¶
- Lazily HTML escapes environment keys in HTTP Exceptions so that those keys in the environ that are not used in the output of the page don't raise an exception due to inability to be properly escaped. See https://github.com/Pylons/webob/pull/139 
- MIMEAccept now accepts comparisons against wildcards, this allows one to match on just the media type or sub-type, without having to explicitly match on both the media type and sub-type at the same time. See https://github.com/Pylons/webob/pull/185 
- Add the ability to return a JSON body from an exception. Using the Accept information in the request, the exceptions will now automatically return a JSON version of the exception instead of just HTML or text. See https://github.com/Pylons/webob/pull/230 and https://github.com/Pylons/webob/issues/209 
Security¶
- exc._HTTPMove and any subclasses will now raise a ValueError if the location field contains a line feed or carriage return. These values may lead to possible HTTP Response Splitting. The header_getter descriptor has also been modified to no longer accept headers with a line feed or carriage return. See: https://github.com/Pylons/webob/pull/229 and https://github.com/Pylons/webob/issues/217 
1.5.1 (2015-10-30)¶
Bug Fixes¶
- The exceptions HTTPNotAcceptable, HTTPUnsupportedMediaType and HTTPNotImplemented will now correctly use the sub-classed template rather than the default error template. See https://github.com/Pylons/webob/issues/221 
- Response's from_file now correctly deals with a status line that contains an HTTP version identifier. HTTP/1.1 200 OK is now correctly parsed, whereas before this would raise an error upon setting the Response.status in from_file. See https://github.com/Pylons/webob/issues/121 
1.5.0 (2015-10-11)¶
Bug Fixes¶
- The cookie API functions will now make sure that max_age is an integer or an string that can convert to an integer. Previously passing in max_age='test' would have silently done the wrong thing. 
Features¶
- Unbreak req.POST when the request method is PATCH. Instead of returning something cmpletely unrelated we return NoVar. See: https://github.com/Pylons/webob/pull/215 
- HTTP Status Code 308 is now supported as a Permanent Redirect. See https://github.com/Pylons/webob/pull/207 
Backwards Incompatibilities¶
- Response.set_cookierenamed the only required parameter from "key" to "name". The code will now still accept "key" as a keyword argument, and will issue a DeprecationWarning until WebOb 1.7.
- The - statusattribute of a- Responseobject no longer takes a string like- None Noneand allows that to be set as the status. It now has to at least match the pattern of- <integer status code> <explenation of status code>. Invalid status strings will now raise a- ValueError.
1.5.0a0 (2015-07-25)¶
Backwards Incompatibilities¶
- Morselwill no longer accept a cookie value that does not meet RFC6265's cookie-octet specification. Upon calling- Morsel.serializea warning will be issued, in the future this will raise a- ValueError, please update your cookie handling code. See https://github.com/Pylons/webob/pull/172- The cookie-octet specification in RFC6265 states the following characters are valid in a cookie value: - Hex Range - Actual Characters - [0x21 ]- !- [0x25-0x2B]- #$%&'()*+- [0x2D-0x3A]- -./0123456789:- [0x3C-0x5B]- <=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[- [0x5D-0x7E]- ]^_`abcdefghijklmnopqrstuvwxyz{|}~- RFC6265 suggests using base 64 to serialize data before storing data in a cookie. - Cookies that meet the RFC6265 standard will no longer be quoted, as this is unnecessary. This is a no-op as far as browsers and cookie storage is concerned. 
- Response.set_cookienow uses the internal- make_cookieAPI, which will issue warnings if cookies are set with invalid bytes. See https://github.com/Pylons/webob/pull/172
Features¶
- Add support for some new caching headers, stale-while-revalidate and stale-if-error that can be used by reverse proxies to cache stale responses temporarily if the backend disappears. From RFC5861. See https://github.com/Pylons/webob/pull/189 
Bug Fixes¶
- Response.status now uses duck-typing for integers, and has also learned to raise a ValueError if the status isn't an integer followed by a space, and then the reason. See https://github.com/Pylons/webob/pull/191 
- Fixed a bug in - webob.multidict.GetDictwhich resulted in the QUERY_STRING not being updated when changes were made to query params using- Request.GET.extend().
- Read the body of a request if we think it might have a body. This fixes PATCH to support bodies. See https://github.com/Pylons/webob/pull/184 
- Response.from_file returns HTTP headers as latin1 rather than UTF-8, this fixes the usage on Google AppEngine. See https://github.com/Pylons/webob/issues/99 and https://github.com/Pylons/webob/pull/150 
- Fix a bug in parsing the auth parameters that contained bad white space. This makes the parsing fall in line with what's required in RFC7235. See https://github.com/Pylons/webob/issues/158 
- Use 'rn' line endings in - Response.__str__. See: https://github.com/Pylons/webob/pull/146
Documentation Changes¶
- response.set_cookienow has proper documentation for- max_ageand- expires. The code has also been refactored to use- cookies.make_cookieinstead of duplicating the code. This fixes https://github.com/Pylons/webob/issues/166 and https://github.com/Pylons/webob/issues/171
- Documentation didn't match the actual code for the wsgify function signature. See https://github.com/Pylons/webob/pull/167 
- Remove the WebDAV only from certain HTTP Exceptions, these exceptions may also be used by REST services for example. 
1.4 (2014-05-14)¶
Features¶
- Remove - webob.__version__, the version number had not been kept in sync with the official pkg version. To obtain the WebOb version number, use- pkg_resources.get_distribution('webob').versioninstead.
Bug Fixes¶
- Fix a bug in - EmptyResponsethat prevents it from setting self.close as appropriate due to testing truthiness of object rather than if it is something other than- None.
- Fix a bug in - SignedSerializerpreventing secrets from containing higher-order characters. See https://github.com/Pylons/webob/issues/136
- Use the - hmac.compare_digestmethod when available for constant-time comparisons.
1.3.1 (2013-12-13)¶
Bug Fixes¶
- Fix a bug in - SignedCookieProfilewhereby we didn't keep the original serializer around, this would cause us to have- SignedSerializerbe added on top of a- SignedSerializerwhich would cause it to be run twice when attempting to verify a cookie. See https://github.com/Pylons/webob/pull/127
Backwards Incompatibilities¶
- When - CookieProfile.get_valueand- SignedCookieProfile.get_valuefails to deserialize a badly encoded value, we now return- Noneas if the cookie was never set in the first place instead of allowing a- ValueErrorto be raised to the calling code. See https://github.com/Pylons/webob/pull/126
1.3 (2013-12-10)¶
Features¶
- Added a read-only - domainproperty to- BaseRequest. This property returns the domain portion of the host value. For example, if the environment contains an- HTTP_HOSTvalue of- foo.example.com:8000,- request.domainwill return- foo.example.com.
- Added five new APIs: - webob.cookies.CookieProfile,- webob.cookies.SignedCookieProfile,- webob.cookies.JSONSerializerand- webob.cookies.SignedSerializer, and- webob.cookies.make_cookie. These APIs are convenience APIs for generating and parsing cookie headers as well as dealing with signing cookies.
- Cookies generated via webob.cookies quoted characters in cookie values that did not need to be quoted per RFC 6265. The following characters are no longer quoted in cookie values: - ~/=<>()[]{}?@. The full set of non-letter-or-digit unquoted cookie value characters is now- !#$%&'*+-.^_`|~/: =<>()[]{}?@. See http://tools.ietf.org/html/rfc6265#section-4.1.1 for more information.
- Cookie names are now restricted to the set of characters expected by RFC 6265. Previously they could contain unsupported characters such as - /.
- Older versions of Webob escaped the doublequote to - \"and the backslash to- \\when quoting cookie values. Now, instead, cookie serialization generates- \042for the doublequote and- \134for the backslash. This is what is expected as per RFC 6265. Note that old cookie values that do have the older style quoting in them will still be unquoted correctly, however.
- Added support for draft status code 451 ("Unavailable for Legal Reasons"). See http://tools.ietf.org/html/draft-tbray-http-legally-restricted-status-00 
- Added status codes 428, 429, 431 and 511 to - util.status_reasons(they were already present in a previous release as- webob.excexceptions).
Bug Fixes¶
- MIMEAccept happily parsed malformed wildcard strings like "image/pn*" at parse time, but then threw an AssertionError during matching. See https://github.com/Pylons/webob/pull/83 . 
- Preserve document ordering of GET and POST request data when POST data passed to Request.blank is a MultiDict. See https://github.com/Pylons/webob/pull/96 
- Allow query strings attached to PATCH requests to populate request.params. See https://github.com/Pylons/webob/pull/106 
- Added Python 3.3 trove classifier. 
1.2.3¶
- Maintainership transferred to Pylons Project <http://www.pylonsproject.org/> 
- Fix parsing of form submissions where fields have transfer-content-encoding headers. 
1.2.2¶
- Fix multiple calls to - cache_expires()not fully overriding the previously set headers.
- Fix parsing of form submissions where fields have different encodings. 
1.2.1¶
- Add index page (e.g., - index.html) support for- webob.static.DirectoryApp.
- Detect mime-type when creating a test request with file uploads ( - Request.blank("/", POST=dict(file1=("foo.jpg", "xxx"))))
- Relax parsing of - Acceptand- Rangeheaders to allow uppercase and extra whitespace.
- Fix docs references to some deprecated classes. 
1.2¶
- Fix - webob.clienthandling of connection-refused on Windows.
- Use - simplejsonin- webob.requestif present.
- Fix - resp.retry_after = <long>interpreting value as a UNIX timestamp (should interpret as time delta in seconds).
1.2rc1¶
- Add - Response.jsonand- Request.jsonwhich reads and sets the body using a JSON encoding (previously only the readable attribute- Request.json_bodyexisted).- Request.json_bodyis still available as an alias.
- Rename - Response.status_intto- Response.status_code(the- .status_intname is still available and will be supported indefinitely).
- Add - Request.text, the unicode version of the request body (similar to- Response.text).
- Add - webob.clientwhich contains the WSGI application- send_request_appand- SendRequest. All requests sent to this application are turned into HTTP requests.
- Renamed - Request.get_response(app)to- Request.send(app). The- .get_response()name is still available.
- Use - send_request_appas the default application for- Request.send(), so you can do:- resp = Request.blank("http://python.org").send()
- Add - webob.staticwhich contains two new WSGI applications,- FileAppserve one static file and- DirectoryAppto serve the content of a directory. They should provide a reusable implementation of WebOb File-Serving Example. It also comes with support for- wsgi.file_wrapper.- The implementation has been imported and simplified from - PasteOb.fileapp.
- Add - devand- docssetup.py aliases (to install development and docs dependencies respectively, e.g. "python setup.py dev").
1.2b3¶
- Added - request.host_portAPI (returns port number implied by HTTP_HOST, falling back to SERVER_PORT).
- Added - request.client_addrAPI (returns IP address implied by HTTP_X_FORWARDED_FOR, falling back to REMOTE_ADDR).
- Fix corner-case - response.status_intand- response.statusmutation bug on py3 (use explicit floor division).
- Backwards incompatibility: Request and BaseRequest objects now return Unicode for - request.path_infoand- request.script_nameunder Python 2. Rationale: the legacy behavior of returning the respective raw environ values was nonsensical on Python 3. Working with non-ascii encoded environ variables as raw WSGI values under Python 3 makes no sense, as PEP 3333 specifies that environ variables are bytes-tunneled-as-latin-1 strings.- If you don't care about Python 3, and you need strict backwards compatibility, to get legacy behavior of returning bytes on Python 2 for these attributes, use - webob.LegacyRequestinstead of- webob.Request. Although it's possible to use- webob.LegacyRequestunder Python 3, it makes no sense, and it should not be used there.
- The above backwards incompatibility fixed nonsensical behavior of - request.host_url,- request.application_url,- request.path_url,- request.path,- request.path_qs,- request.url,- request.relative_url,- request.path_info_peek,- request.path_info_popunder Python 3. These methods previously dealt with raw SCRIPT_NAME and PATH_INFO values, which caused nonsensical results.
- The WebOb Request object now respects an additional WSGI environment variable: - webob.url_encoding.- webob.url_encodingwill be used to decode the raw WSGI PATH_INFO and SCRIPT_NAME variables when the- request.path_infoand- request.script_nameAPIs are used.
- Request objects now accept an additional constructor parameter: - url_encoding.- url_encodingwill be used to decode PATH_INFO and SCRIPT_NAME from its WSGI-encoded values. If- webob.url_encodingis not set in the environ and- url_encodingis not passed to the Request constructor, the default value- utf-8will be used to decode the PATH_INFO and SCRIPT_NAME.- Note that passing - url_encodingwill cause the WSGI environment variable- webob.url_encodingto be set.
- Fix - webob.response._request_uriinternal function to generate sensible request URI under Python 3. This fixed a problem under Python 3 if you were using non-absolute Location headers in responses.
1.2b2¶
- Fix - request.cookies.get('name', 'default'). Previously- defaultwas ignored.
1.2b1¶
- Mutating the - request.cookiesproperty now reflects the mutations into the- HTTP_COOKIESenviron header.
- Response.etag = (tag, False)sets weak etag.
- Rangeonly parses single range now.
- Range.satisfiable(..)is gone.
- Accept.best_matches()is gone; use- list(request.accept)or- request.accept.best_match(..)instead (applies to all Accept-* headers) or similar with- request.accept_language.
- Response.requestand- Response.environattrs are undeprecated and no longer raise exceptions when used. These can also be passed to the Response constructor. This is to support codebases that pass them to the constructor or assign them to a response instance. However, some behavior differences from 1.1 exist. In particular, synchronization is no longer done between environ and request attribute properties of Response; you may pass either to the constructor (or both) or assign one or the other or both, but they wont be managed specially and will remain the same over the lifetime of the response just as you passed them. Default values for both- requestand- environon any given response are- Nonenow.
- Undeprecated - uscript_nameand- upath_info.
- For backwards compatibility purposes, switch - req.script_nameand- path_infoback again to contain "raw" undecoded native strings rather than text. Use- uscript_nameand- upath_infoto get the text version of SCRIPT_NAME and PATH_INFO.
- Don't raise an exception if - unicode_errorsor- decode_param_namesis passed to the Request constructor. Instead, emit a warning. For benefit of Pylons 1.X, which passes both.
- Don't raise an exception if HTTPException.exception is used; instead emit a warning. For benefit of Pylons 1.X, which uses it. 
1.2a2¶
- req.script_nameand- path_infonow contain text, not bytes.
- Deprecated - uscript_nameand- upath_info.
- charsetargument to- Requestas well as the attribute can only be set to UTF-8 or the value already present in the- Content-Typeheader.
- unicode_errorsattribute of- Requestand related functionality is gone.
- To process requests that come in an encoding different from UTF-8, the request needs to be transcoded like this: - req = req.decode('windows-1251')
- Added support for weak ETag matching in conditional responses. 
- Most of etag-related functionality was refactored. 
1.2a1¶
- Python 3.2 compatibility. 
- No longer compatible with Python 2.5 (only 2.6, 2.7, and 3.2 are supported). 
- Switched VCS from Mercurial to Git 
- Moved development to GitHub 
- Added full history from PyCon 2011 sprint to the repository 
- Change - LimitedLengthFileand- FakeCGIBodyto inherit from- io.RawIOBaseand benefit from- io.BufferedReader.
- Do not set - resp.requestin- req.get_response(app)
- Response.requestand- .environattrs are deprecated and raise exceptions when used.
- Deprecated request attributes - str_GET,- str_POST,- str_cookiesand- str_paramsnow raise exceptions when touched.
- Remove testing dependency on WebTest. 
- Remove UnicodeMultiDict class; the result of - Request.GETand- Request.POSTis now just a plain- MultiDict.
- The - decode_param_namesRequest constructor argument has been removed, along with the- Request.decode_param_namesattribute.
- The - Request.as_string()method is now better known as- Request.as_bytes().
- The - Request.from_string()method is now better known as- Request.from_bytes().
- A new method named - Request.as_text()now exists.
- A new method named - Request.from_text()now exists.
- The - webob.dec.wsgifyrepr() is now much less informative, but a lot easier to test and maintain.
1.1.1¶
- Fix disconnect detection being incorrect in some cases (issue 21). 
- Fix exception when calling - .accept.best_match(..)on a header containing- '*'(instead of- '*/*').
- Extract some of the - Acceptcode into subclasses (- AcceptCharset,- AcceptLanguage).
- Improve language matching so that the app can now offer a generic language code and it will match any of the accepted dialects ( - 'en' in AcceptLanguage('en-gb')).
- Normalize locale names when matching ( - 'en_GB' in AcceptLanguage('en-gb')).
- Deprecate - etag.weak_match(..).
- Deprecate - Response.requestand- Response.environattrs.
1.1¶
- Remove deprecation warnings for - unicode_bodyand- ubody.
1.1rc1¶
- Deprecate - Response.ubody/- .unicode_bodyin favor of new- .textattribute (the old names will be removed in 1.3 or even later).
- Make - Response.writemuch more efficient (issue 18).
- Make sure copying responses does not reset Content-Length or Content-MD5 of the original (and that of future copies). 
- Change - del res.bodysemantics so that it doesn't make the response invalid, but only removes the response body.
- Remove - Response._bodyso the- _app_iteris the only representation.
1.1b2¶
- Add detection for browser / user-agent disconnects. If the client disconnected before sending the entire request body (POST / PUT), - req.POST,- req.bodyand other related properties and methods will raise an exception. Previously this caused the application get a truncated request with no indication that it is incomplete.
- Make - Response.body_filesettable. This is now valid:- Response(body_file=open('foo.bin'), content_type=...)
- Revert the restriction on req.body not being settable for GET and some other requests. Such requests actually can have a body according to HTTP BIS (see also commit message) 
- Add support for file upload testing via - Request.blank(POST=..). Patch contributed by Tim Perevezentsev. See also: ticket, changeset.
- Deprecate - req.str_GET,- str_POST,- str_paramsand- str_cookies(warning).
- Deprecate - req.decode_param_names(warning).
- Change - req.decode_param_namesdefault to- True. This means that- .POST,- .GET,- .paramsand- .cookieskeys are now unicode. This is necessary for WebOb to behave as close as possible on Python 2 and Python 3.
1.1b1¶
- We have acquired the webob.org domain, docs are now hosted at docs.webob.org 
- Make - accept.quality(..)return best match quality, not first match quality.
- Fix - Range.satisfiable(..)edge cases.
- Make sure - WSGIHTTPExceptioninstances return the same headers for- HEADand- GETrequests.
- Drop Python 2.4 support 
- Deprecate - HTTPException.exception(warning on use).
- Deprecate - accept.first_match(..)(warning on use). Use- .best_match(..)instead.
- Complete deprecation of - req.[str_]{post|query}varsproperties (exception on use).
- Remove - FakeCGIBody.seekhack (no longer necessary).
1.0.8¶
- Escape commas in cookie values (see also: stdlib Cookie bug) 
- Change cookie serialization to more closely match how cookies usually are serialized (unquoted expires, semicolon separators even between morsels) 
- Fix some rare cases in cookie parsing 
- Enhance the req.is_body_readable to always guess GET, HEAD, DELETE and TRACE as unreadable and PUT and POST as readable (issue 12) 
- Deny setting req.body or req.body_file to non-empty values for GET, HEAD and other bodiless requests 
- Fix running nosetests with arguments on UNIX systems (issue 11) 
1.0.7¶
- Fix - Acceptheader matching for items with zero-quality (issue 10)
- Hide password values in - MultiDict.__repr__
1.0.6¶
- Use - environ['wsgi.input'].read()instead of- .read(-1)because the former is explicitly mentioned in PEP-3333 and CherryPy server does not support the latter.
- Add new - environ['webob.is_body_readable']flag which specifies if the input stream is readable even if the- CONTENT_LENGTHis not set. WebOb now only ever reads the input stream if the content-length is known or this flag is set.
- The two changes above fix a hangup with CherryPy and wsgiref servers (issue 6) 
- req.body_fileis now safer to read directly. For- GETand other similar requests it returns an empty- StringIOor- BytesIOobject even if the server passed in something else.
- Setting - req.body_fileto a string now produces a PendingDeprecationWarning. It will produce DeprecationWarning in 1.1 and raise an error in 1.2. Either set- req.body_fileto a file-like object or set- req.bodyto a string value.
- Fix - .pop()and- .setdefault(..)methods of- req/resp.cache_control
- Thanks to the participants of Pyramid sprint at the PyCon US 2011 WebOb now has 100% test coverage. 
1.0.5¶
- Restore Python 2.4 compatibility. 
1.0.4¶
- The field names escaping bug semi-fixed in 1.0.3 and originally blamed on cgi module was in fact a - webob.request._encode_multipartbug (also in Google Chrome) and was lurking in webob code for quite some time -- 1.0.2 just made it trigger more often. Now it is fixed properly.
- Make sure that req.url and related properties do not unnecessarily escape some chars ( - :@&+$) in the URI path (issue 5)
- Revert some changes from 1.0.3 that have broken backwards compatibility for some apps. Getting - req.body_filedoes not make input stream seekable, but there's a new property- req.body_file_seekablethat does.
- Request.get_responseand- Request.call_applicationseek the input body to start before calling the app (if possible).
- Accessing - req.body'rewinds' the input stream back to pos 0 as well.
- When accessing - req.POSTwe now avoid making the body seekable as the input stream data are preserved in- FakeCGIBodyanyway.
- Add new method - Request.from_string.
- Make sure - Request.as_string()uses CRLF to separate headers.
- Improve parity between - Request.as_string()and- .from_file/- .from_stringmethods, so that the latter can parse output of the former and create a similar request object which wasn't always the case previously.
1.0.3¶
- Correct a caching issue introduced in WebOb 1.0.2 that was causing unnecessary reparsing of POST requests. 
- Fix a bug regarding field names escaping for forms submitted as - multipart/form-data. For more infromation see the bug report and discussion and 1.0.4 notes for further fix.
- Add - req.http_versionattribute.
1.0.2¶
- Primary maintainer is now Sergey Schetinin. 
- Issue tracker moved from Trac to bitbucket's issue tracker 
- WebOb 1.0.1 changed the behavior of - MultiDict.updateto be more in line with other dict-like objects. We now also issue a warning when we detect that the client code seems to expect the old, extending semantics.
- Make - Response.set_cookie(key, None)set the 'delete-cookie' (same as- .delete_cookie(key))
- Make - req.upath_infoand- req.uscript_namesettable
- Add :meth: - Request.as_string()method
- Add a - req.is_body_seekableproperty
- Support for the - deflatemethod with- resp.decode_content()
- To better conform to WSGI spec we no longer attempt to use seek on - wsgi.inputfile instead we assume it is not seekable unless- env['webob.is_body_seekable']is set. When making the body seekable we set that flag.
- A call to - req.make_body_seekable()now guarantees that the body is seekable, is at 0 position and that a correct- req.content_lengthis present.
- req.body_fileis always seekable. To access- env['wsgi.input']without any processing, use- req.body_file_raw. (Partially reverted in 1.0.4)
- Fix responses to HEAD requests with Range. 
- Fix - del resp.content_type,- del req.body,- del req.cache_control
- Fix - resp.merge_cookies()when called with an argument that is not a Response instance.
- Fix - resp.content_body = None(was removing Cache-Control instead)
- Fix - req.body_file = fsetting- CONTENT_LENGTHto- -1(now removes from environ)
- Fix: make sure req.copy() leaves the original with seekable body 
- Fix handling of WSGI environs with missing - SCRIPT_NAME
- A lot of tests were added by Mariano Mara and Danny Navarro. 
1.0.1¶
- As WebOb requires Python 2.4 or later, drop some compatibility modules and update the code to use the decorator syntax. 
- Implement optional on-the-fly response compression ( - resp.encode_content(lazy=True))
- Drop - util.safezipmodule and make- utila module instead of a subpackage. Merge- statusreasonsinto it.
- Instead of using stdlib - Cookiewith monkeypatching, add a derived but thoroughly rewritten, cleaner, safer and faster- webob.cookiesmodule.
- Fix: - Response.merge_cookiesnow copies the headers before modification instead of doing it in-place.
- Fix: setting request header attribute to - Nonedeletes that header. (Bug only affected the 1.0 release).
- Use - io.BytesIOfor the request body file on Python 2.7 and newer.
- If a UnicodeMultiDict was used as the - multiargument of another UnicodeMultiDict, and a- cgi.FieldStoragewith a- filenamewith high-order characters was present in the underlying UnicodeMultiDict, a- UnicodeEncodeErrorwould be raised when any helper method caused the- _decode_valuemethod to be called, because the method would try to decode an already decoded string.
- Fix tests to pass under Python 2.4. 
- Add descriptive docstrings to each exception in - webob.exc.
- Change the behaviour of - MultiDict.updateto overwrite existing header values instead of adding new headers. The extending semantics are now available via the- extendmethod.
- Fix a bug in - webob.exc.WSGIHTTPException.__init__. If a list of- headerswas passed as a sequence which contained duplicate keys (for example, multiple- Set-Cookieheaders), all but one of those headers would be lost, because the list was effectively flattened into a dictionary as the result of calling- self.headers.update. Fixed via calling- self.headers.extendinstead.
1.0¶
- 1.0, yay! 
- Pull in werkzeug Cookie fix for malformed cookie bug. 
- Implement - Request.from_file()and- Response.from_file()which are kind of the inversion of- str(req)and- str(resp)
- Add optional - patternargument to- Request.path_info_pop()that requires the- path_infosegment to match the passed regexp to get popped and returned.
- Rewrite most of descriptor implementations for speed. 
- Reorder descriptor declarations to group them by their semantics. 
- Move code around so that there are fewer compat modules. 
- Change :meth: - HTTPError.__str__to better conform to PEP 352.
- Make - Request.cache_controla view on the headers.
- Correct Accept-Language and Accept-Charset matching to fully conform to the HTTP spec. 
- Expose parts of - Request.blank()as- environ_from_url()and- environ_add_POST()
- Fix Authorization header parsing for some corner cases. 
- Fix an error generated if the user-agent sends a 'Content_Length' header (note the underscore). 
- Kill - Request.default_charset. Request charset defaults to UTF-8. This ensures that all values in- req.GET,- req.POSTand- req.paramsare always unicode.
- Fix the - headerlistand- content_typeconstructor arguments priorities for- HTTPErrorand subclasses.
- Add support for weak etags to conditional Response objects. 
- Fix locale-dependence for some cookie dates strings. 
- Improve overall test coverage. 
- Rename class - webob.datastruct.EnvironHeadersto- webob.headers.EnvironHeaders
- Rename class - webob.headerdict.HeaderDictto- webob.headers.ResponseHeaders
- Rename class - webob.updatedict.UpdateDictto- webob.cachecontrol.UpdateDict
0.9.8¶
- Fix issue with WSGIHTTPException inadvertently generating unicode body and failing to encode it 
- WWW-Authenticate response header is accessible as - response.www_authenticate
- response.www_authenticateand- request.authorizationhold None or tuple- (auth_method, params)where- paramsis a dictionary (or a string when- auth_methodis not one of known auth schemes and for Authenticate: Basic ...)
- Don't share response headers when getting a response like - resp = req.get_response(some_app); this can avoid some funny errors with modifying headers and reusing Response objects.
- Add overwrite argument to - Response.set_cookie()that make the new value overwrite the previously set. False by default.
- Add strict argument to - Response.unset_cookie()that controls if an exception should be raised in case there are no cookies to unset. True by default.
- Fix - req.GET.copy()
- Make sure that 304 Not Modified responses generated by - Response.conditional_response_app()exclude Content-{Length/Type} headers
- Fix - Response.copy()not being an independent copy
- When the requested range is not satisfiable, return a 416 error (was returning entire body) 
- Truncate response for range requests that go beyond the end of body (was treating as invalid). 
0.9.7.1¶
- Fix an import problem with Pylons 
0.9.7¶
- Moved repository from svn location to http://bitbucket.org/ianb/webob/ 
- Arguments to - Accept.best_match()must be specific types, not wildcards. The server should know a list of specic types it can offer and use- best_matchto select a specific one.
- With - req.accept.best_match([types])prefer the first type in the list (previously it preferred later types).
- Also, make sure that if the user-agent accepts multiple types and there are multiple matches to the types that the application offers, - req.accept.best_match([..])returns the most specific match. So if the server can satisfy either- image/*or- text/plaintypes, the latter will be picked independent from the order the accepted or offered types are listed (given they have the same quality rating).
- Fix Range, Content-Range and AppIter support all of which were broken in many ways, incorrectly parsing ranges, reporting incorrect content-ranges, failing to generate the correct body to satisfy the range from - app_iteretc.
- Fix assumption that presense of a - seekmethod means that the stream is seekable.
- Add - ubodyalias for- Response.unicode_body
- Add Unicode versions of - Request.script_nameand- path_info:- uscript_nameand- upath_info.
- Split __init__.py into four modules: request, response, descriptors and datetime_utils. 
- Fix - Response.bodyaccess resetting Content-Length to zero for HEAD responses.
- Support passing Unicode bodies to - WSGIHTTPExceptionconstructors.
- Make - bool(req.accept)return- Falsefor requests with missing Accept header.
- Add HTTP version to - Request.__str__()output.
- Resolve deprecation warnings for parse_qsl on Python 2.6 and newer. 
- Fix - Response.md5_etag()setting Content-MD5 in incorrect format.
- Add - Request.authorizationproperty for Authorization header.
- Make sure ETag value is always quoted (required by RFC) 
- Moved most - Requestbehavior into a new class named- BaseRequest. The- Requestclass is now a superclass for- BaseRequestand a simple mixin which manages- environ['webob.adhoc_attrs']when- __setitem__,- __delitem__and- __getitem__are called. This allows framework developers who do not want the- environ['webob.adhoc_attrs']mutation behavior from- __setattr__. (chrism)
- Added response attribute - response.content_dispositionfor its associated header.
- Changed how - charsetis determined on- webob.Requestobjects. Now the- charsetparameter is read on the Content-Type header, if it is present. Otherwise a- default_charsetparameter is read, or the- charsetargument to the Request constructor. This is more similar to how- webob.Responsehandles the charset.
- Made the case of the Content-Type header consistent (note: this might break some doctests). 
- Make - req.GETsettable, such that- req.environ['QUERY_STRING']is updated.
- Fix problem with - req.POSTcausing a re-parse of the body when you instantiate multiple- Requestobjects over the same environ (e.g., when using middleware that looks at- req.POST).
- Recreate the request body properly when a - POSTincludes file uploads.
- When - req.POSTis updated, the generated body will include the new values.
- Added a - POSTparameter to- webob.Request.blank(); when given this will create a request body for the POST parameters (list of two-tuples or dictionary-like object). Note: this does not handle unicode or file uploads.
- Added method - webob.Response.merge_cookies(), which takes the- Set-Cookieheaders from a Response, and merges them with another response or WSGI application. (This is useful for flash messages.)
- Fix a problem with creating exceptions like - webob.exc.HTTPNotFound(body='<notfound/>', content_type='application/xml')(i.e., non-HTML exceptions).
- When a Location header is not absolute in a Response, it will be made absolute when the Response is called as a WSGI application. This makes the response less bound to a specific request. 
- Added - webob.dec, a decorator for making WSGI applications from functions with the signature- resp = app(req).
0.9.6.1¶
- Fixed - Response.__init__(), which for some content types would raise an exception.
- The - req.bodyproperty will not recreate a StringIO object unnecessarily when rereading the body.
0.9.6¶
- Removed environ_getter from - webob.Request. This largely-unused option allowed a Request object to be instantiated with a dynamic underlying environ. Since it wasn't used much, and might have been ill-advised from the beginning, and affected performance, it has been removed (from Chris McDonough).
- Speed ups for - webob.Response.__init__()and- webob.Request.__init__()
- Fix defaulting of - CONTENT_TYPEinstead of- CONTENT_LENGTHto 0 in- Request.str_POST.
- Added - webob.Response.copy()
0.9.5¶
- Fix - Request.blank('/').copy()raising an exception.
- Fix a potential memory leak with HEAD requests and 304 responses. 
- Make - webob.html_escape()respect the- .__html__()magic method, which allows you to use HTML in- webob.exc.HTTPExceptioninstances.
- Handle unicode values for - resp.location.
- Allow arbitrary keyword arguments to - exc.HTTP*(the same keywords you can send to- webob.Response).
- Allow setting - webob.Response.cache_expires()(usually it is called as a method). This is primarily to allow- Response(cache_expires=True).
0.9.4¶
- Quiet Python 2.6 deprecation warnings. 
- Added an attribute - unicode_errorsto- webob.Response-- if set to something like- unicode_errors='replace'it will decode- resp.bodyappropriately. The default is- strict(which was the former un-overridable behavior).
0.9.3¶
- Make sure that if changing the body the Content-MD5 header is removed. (Otherwise a lot of middleware would accidentally corrupt responses). 
- Fixed - Response.encode_content('identity')case (was a no-op even for encoded bodies).
- Fixed - Request.remove_conditional_headers()that was removing If-Match header instead of If-None-Match.
- Fixed - resp.set_cookie(max_age=timedelta(...))
- request.POSTnow supports PUT requests with the appropriate Content-Type.
0.9.2¶
- Add more arguments to - Request.remove_conditional_headers()for more fine-grained control: remove_encoding, remove_range, remove_match, remove_modified. All of them are True by default.
- Add an set_content_md5 argument to - Response.md5_etag()that calculates and sets Content-MD5 reponse header from current body.
- Change formatting of cookie expires, to use the more traditional format - Wed, 5-May-2001 15:34:10 GMT(dashes instead of spaces). Browsers should deal with either format, but some other code expects dashes.
- Added in - sortedfunction for backward compatibility with Python 2.3.
- Allow keyword arguments to - webob.Request, which assign attributes (possibly overwriting values in the environment).
- Added methods - webob.Request.make_body_seekable()and- webob.Request.copy_body(), which make it easier to share a request body among different consuming applications, doing something like req.make_body_seekable(); req.body_file.seek(0)
0.9.1¶
- request.params.copy()now returns a writable MultiDict (before it returned an unwritable object).
- There were several things broken with - UnicodeMultiDictwhen- decode_param_namesis turned on (when the dictionary keys are unicode).
- You can pass keyword arguments to - Request.blank()that will be used to construct- Request(e.g.,- Request.blank('/', decode_param_names=True)).
- If you set headers like - response.etagto a unicode value, they will be encoded as ISO-8859-1 (however, they will remain encoded, and- response.etagwill not be a unicode value).
- When parsing, interpret times with no timezone as UTC (previously they would be interpreted as local time). 
- Set the Expires property on cookies when using - response.set_cookie(). This is inherited from- max_age.
- Support Unicode cookie values 
0.9¶
- Added - req.urlarg, which represents positional arguments in- environ['wsgiorg.routing_args'].
- For Python 2.4, added attribute get/set proxies on exception objects from, for example, - webob.exc.HTTPNotFound().exception, so that they act more like normal response objects (despite not being new-style classes or- webob.Responseobjects). In Python 2.5 the exceptions are- webob.Responseobjects.
Backward Incompatible Changes¶
- The - Responseconstructor has changed: it is now- Response([body], [status], ...)(before it was- Response([status], [body], ...)). Body may be str or unicode.
- The - Responseclass defaults to- text/htmlfor the Content-Type, and- utf8for the charset (charset is only set on- text/*and- application/*+xmlresponses).
Bugfixes and Small Changes¶
- Use - BaseCookieinstead of- SimpleCookiefor parsing cookies.
- Added - resp.write(text)method, which is equivalent to- resp.body += textor- resp.unicode_body += text, depending on the type of- text.
- The - decode_param_namesargument (used like- Request(decode_param_names=True)) was being ignored.
- Unicode decoding of file uploads and file upload filenames were causing errors when decoding non-file-upload fields (both fixes from Ryan Barrett). 
0.8.5¶
- Added response methods - resp.encode_content()and- resp.decode_content()to gzip or ungzip content.
- Response(status=404)now works (before you would have to use- status="404 Not Found").
- Bugfix (typo) with reusing POST body. 
- Added - 226 IM Usedresponse status.
- Backport of - string.Templateincluded for Python 2.3 compatibility.
0.8.4¶
- __setattr__would keep- Requestsubclasses from having properly settable environ proxies (like- req.path_info).
0.8.3¶
- request.POSTwas giving FieldStorage objects for every attribute, not just file uploads. This is fixed now.
- Added request attributes - req.server_nameand- req.server_portfor the environ keys- SERVER_NAMEand- SERVER_PORT.
- Avoid exceptions in - req.content_length, even if- environ['CONTENT_LENGTH']is somehow invalid.
0.8.2¶
- Python 2.3 compatibility: backport of - reversed(seq)
- Made separate - .exceptionattribute on- webob.excobjects, since new-style classes can't be raised as exceptions.
- Deprecate - req.postvarsand- req.queryvars, instead using the sole names- req.GETand- req.POST(also- req.str_GETand- req.str_POST). The old names give a warning; will give an error in next release, and be completely gone in the following release.
- req.user_agentis now just a simple string (parsing the User-Agent header was just too volatile, and required too much knowledge about current browsers). Similarly,- req.referer_search_query()is gone.
- Added parameters - versionand- commentto- Response.set_cookie(), per William Dode's suggestion.
- Was accidentally consuming file uploads, instead of putting the - FieldStorageobject directly in the parameters.
0.8.1¶
- Added - res.set_cookie(..., httponly=True)to set the- HttpOnlyattribute on the cookie, which keeps Javascript from reading the cookie.
- Added some WebDAV-related responses to - webob.exc
- Set default - Last-Modifiedwhen using- response.cache_expire()(fixes issue with Opera)
- Generally fix - .cache_control
0.8¶
First release. Nothing is new, or everything is new, depending on how you think about it.