static digested files without prefix get 404

[ruslandoga]

👋

Environment

• Elixir version (elixir -v): 1.18.2
• Phoenix version (mix deps): 1.7.14
• Operating system:

Actual behavior

It seems like a static digested site.webmanifest is not being served by Plug.Static.

def static_paths, do: ~w(assets fonts images favicon.ico robots.txt site.webmanifest)

iex> File.ls("lib/bend-0.1.0/priv/static")
#==> {:ok,
#==>  [..., "site-c0c4f1c0f3ba8cb5034fdd9d1aafa9aa.webmanifest",
#==>   "favicon-91f37b602a111216f1eef3aa337ad763.ico", "site.webmanifest",
#==>   "favicon-07f80321aa54b0c7f90564a833181023.ico"]}

the Plug.Static inited opts are

%{
  at: [],
  from: {:my_app, "priv/static"},
  headers: %{},
  only_rules: {["assets", "fonts", "images", "favicon.ico", "robots.txt",
    "site.webmanifest"], []},
  encodings: [{"gzip", ".gz"}],
  content_types: %{},
  et_cache: "public",
  et_generation: nil,
  qs_cache: "public, max-age=31536000, immutable"
}

and the requested path for site.webmanifest is

10:22:46.417 request_id=GDdik4hrQd68HZoAGg-D [info] GET /site-c0c4f1c0f3ba8cb5034fdd9d1aafa9aa.webmanifest
10:22:46.419 request_id=GDdik4hrQd68HZoAGg-D [info] Sent 404 in 1ms

I think the problem might also affect (digested) favicons and robots.txt but I haven't checked.

Expected behavior

All digested files get served :)

[ruslandoga]

I noticed that https://github.com/elixir-plug/plug/blob/4af671374a73d33b4a4b003ce8c84a4173428030/lib/plug/static.ex#L223 returns false for this request.

iex> h
#==> "site-c0c4f1c0f3ba8cb5034fdd9d1aafa9aa.webmanifest"

iex> full
#==> ["assets", "fonts", "images", "favicon.ico", "robots.txt", "site.webmanifest"]

iex> prefix
#==> []

iex> h in full or (prefix != [] and match?({0, _}, :binary.match(h, prefix)))
#==> false

Should Phoenix configure Plug.Static to be able to match digested files "without prefix"? By maybe passing the cache_manifest to Plug.Static only_rules

[SteffenDE]

Good question! By default, the only files served from / are favicon.ico and robots.txt and it doesn't make much sense to digest those (as the browser requests favicon.ico by default, and crawlers will just try robots.txt). So while mix phx.digest still digests them, it is fine that we don't actually serve them.

With that in mind, I don't think adding the extra prefix != [] and match?({0, _}, :binary.match(h, prefix)) check for every incoming request should be the default. Maybe it would be enough to add an extra code comment to the endpoint that mentions only_matching - do you want to send a PR?

[ruslandoga]

👋

Maybe it would be enough to add an extra code comment to the endpoint that mentions only_matching - do you want to send a PR?

How would it solve the site-c0c4f1c0f3ba8cb5034fdd9d1aafa9aa.webmanifest problem?

[josevalim]

You can use the :only_matching option from Plug.Static instead: https://hexdocs.pm/plug/Plug.Static.html#module-options :)

[ruslandoga]

I don't see how :only_matching helps in my case.

FWIW I went with a custom plug that intercepts site.webmanifest requests and renders it dynamically, no caching.

[josevalim]

Couldn't you pass site- to only_matching, so you can serve anything matching site-?

[ruslandoga]

Ah, I see. Thank you, I'll try that.

[SteffenDE]

@ruslandoga sorry, I forgot to answer :(

I think serving digested files at the root is always a bit tricky, so I'd recommend to just move the manifest to a subfolder instead.

[brendon9x]

Hi all. I wonder if there is anything we could do to make this less of a trap? Especially for people newer to the framework. The route to falling into the trap is as follows:

1. Run mix phx.new foo
2. Decide you want an SVG Favicon
3. Add a <link rel="icon" type="image/svg+xml" href={~p"favicon.svg"} />
4. Enter the trap

I am pretty experienced and I'm a bit embarrassed how long I spent on this :)

FWIW, the LLMs walk into this trap as well. They're inclined to the ~p sigil and not educated on the subtleties of only_matching vs only. You can just ask "I would like to replace the favicon.ico with this svg file" and Claude will change the FooWeb.static_paths() function to svg, create the <link> tag and use a verified routes sigil.

Not sure about options here and their tradeoffs?

1. Could only_matching be the default? (are there performance concerns?)
2. Rename only to only_with_prefix_dirs and deprecate the only key (with warning log)
3. Just leave a clue for the LLMs in the generated endpoint via comment?

[josevalim]

We could have an option on plug that raises if it matches something undeclared. And we only enable this option if code_reloading? Is true. But we will need to update Plug.Static first. Would you like to send a PR?