Step 1 of 5 · Reading · ~3 min
Read
Routing & Responses
Static Path Routing
A parsed request has a method and a target. Your server has handlers. Routing is the map between them, and with exact paths only (patterns come next lesson) you can concentrate on what makes a router different from a dictionary: what it says when nothing matches, and how it cleans the target before looking anything up.
The route table
GET / -> index
GET /about -> about
POST /api/users -> create_user
GET /api/users -> list_users
The key is the pair (method, path). GET /api/users and POST /api/users are different routes with different handlers, which is how REST says "same resource, different verb". A map keyed on the path alone cannot hold both.
Three kinds of "no match"
- Unknown path: nothing is registered under any method.
404 Not Found. - Known path, wrong method:
DELETE /api/userswhen only GET and POST exist. The lazy answer is 404. The correct answer is405 Method Not Allowedplus anAllowheader listing what would work. 404 says "nothing here", 405 says "something is here, you used the wrong verb". To tell them apart you must index by path first and by method inside it, which is also what lets you build theAllowlist. - HEAD: a path with a GET handler must also answer HEAD (same status and headers, no body, as in the response lesson). A router does this for you unless a HEAD handler was registered explicitly. HEAD therefore appears in the
Allowlist whenever GET does.
Clean the target before lookup
The request target is not a path yet. Apply these steps in this order:
- Cut the query string at the first
?./about?ref=footerroutes as/about. - Percent-decode once.
%61isa, so/ab%6Futis/about. A%that is not followed by two hex digits is malformed, and so is a decoded NUL (%00):400 Bad Request. Decode exactly once:/%2561boutbecomes/%61bout, not/about. Decoding twice is how a request that passed your checks turns into a different request after them. - Trailing slash. This course treats
/about/and/aboutas the same route: if the path is longer than one character and ends with/, drop that one slash. The root/is left alone. - Match case-sensitively.
/Aboutis not/about.
Registration time
Registering the same (method, path) twice is a programming error, and real routers fail fast at startup rather than let the second handler silently shadow the first. This course keeps the first registration and reports duplicate <METHOD> <path> for the second.
Worked trace
With the table above plus HEAD /health -> health_head:
| Request line | Cleaned path | Result |
|---|---|---|
GET /about?ref=footer HTTP/1.1 | /about | 200 about |
HEAD /about HTTP/1.1 | /about | 200 about (GET fallback) |
DELETE /api/users HTTP/1.1 | /api/users | 405 Allow: GET, HEAD, POST |
GET /api%2Fusers HTTP/1.1 | /api/users | 200 list_users |
GET /About HTTP/1.1 | /About | 404 |
GET /a%zz HTTP/1.1 | none | 400 |
Common mistakes
- Answering 404 for a wrong method, so clients never learn what is allowed.
- Matching before cleaning, so
/about?x=1and/ab%6Futare 404s. - Decoding twice, which makes
/%2561boutreach/about. - Listing
Allowin registration order. Sort the methods alphabetically so the answer does not depend on file order. - Forgetting that
HEADbelongs in theAllowlist.
Your exercise
The input is a route table, an empty line, and request lines as they arrive from the previous stage. The starter reads both and gives you a path-first table. You clean each target and decide between 200, 404, 405 and 400.
Discussion
Ask a question, share an insight, or help someone who’s stuck.
Sign in to post a comment or reply.
Loading…