Fix for form submit stripping query string parameters - #19

❤️ thanks for the fix. The only thing missing is a test, so if you could add one, that'd be great.

Anyway, I've just made you a collaborator on this repo, so you can merge this yourself once you're happy with it.

If you let me know what your npm account is, I can also give you publish access there!

@felixge Do you think it's good idea to keep query string for POST request by default?

@alexindigo not sure, your call

I think it should be kept optional, since POSTing to the URL with query_string attached is edge case.

@jezell Can you provide more details on your use case?

Thank you.

The URL itself should be all you need to know to determine if someone wants to use a query string. In what case would I include a querystring in my URL and want it to be ignored? Sure it's optional, but it's already an optional part of the URL. The way you specify if you want to use one shouldn't be an additional flag somewhere, it should be the URL itself.

In my case I needed to append an OAuth access token to a URL in order for the call to succeed.

If you the URL you're POSTing to comes to you from pipeline you want to be safe and not to introduce extra parameters to the server, you have no control over. I mean from FromData point of view.

What's the problem with adding OAuth access token to the POST data?

var form = new  FormData();

form.append('access_token', my_oauth_token);

As I see it in this case you fully control data you're sending to the server.

I believe it's good thing to make conscience choice, so if you have that edge when you can't POST some of the data while actually performing POST request. It should be explicit.

Pass flag to your form instance, like:

var form = new FormData({ preserve_query_string: true });

And maintainers of your project/code would thank you many times while debugging your stuff,
and trying to understand why there is 6 parameters on the server side when they see only 5 added
to your FormData instance.

form.append('access_token', my_oauth_token)

Wouldn't this result in the token being sent as part of the request body, and not as part of the URL? I am familiar with passing OAuth tokens in an auth header and as a query string parameter, but does the spec even allow for passing tokens as part of the body?

The method this pull request was for was the submit method:

FormData.prototype.submit = function(url, cb) {

The method has a parameter 'url', which I assumed was actually an URL, but is throwing away part of the URL and not actually functioning as a URL. When I create an HTML form, I don't have to add an extra attribute to my form to tell it to not to ignore half of the URL inside my action attribute. The fact that I told it to submit to that URL means I want it to submit to that URL. It's not confusing when it actually submits to that URL, it's confusing when it doesn't.

OAuth tokens should be sent as HTTP header.

Authorization: OAuth realm="http://sp.example.com/",
                oauth_consumer_key="0685bd9184jfhq22",
                oauth_token="ad180jjd733klru7",
                oauth_signature_method="HMAC-SHA1",
                oauth_signature="wOJIO9A2W5mFwDgiDvZbTSMK%2FPY%3D",
                oauth_timestamp="137131200",
                oauth_nonce="4572616e48616d6d65724c61686176",
                oauth_version="1.0"

http://oauth.net/core/1.0a/#auth_header

Some providers (ex. LinkedIn) accept it as query string for GET requests only.

And you might want to take a look at mikeal/request,
it does OAuth (to some extent) and utilizes form-data for file uploads.

Should have clarified that this is OAuth 2 bearer token, not OAuth 1, which makes no distinction about not being able to use URI query string format for POST requests.

http://self-issued.info/docs/draft-ietf-oauth-v2-bearer.html

Certainly, the recommended way to do this in production is to use an HTTP header. However, pre-HTML5 I'm not sure how that would actually be accomplished with a multipart form post.

Regardless, it would be easy to use the form pipe with node-form-data to have complete control over the request, but it's a bit weird to me that the convenience method with a url parameter that ignores part of the URL. The whole point of using submit instead of pipe seems to be that it parses the URL and submits the request for you without having to jump through a lot of hoops.

I have idea, how to make it good for everybody :)
Hold on.

Now (#22) you can specify custom path or any other parameter (supported by http.request()) when calling form.submit()
For example code please refer to the Readme.

Thank you.