It's a starting point, but let's focus on "only use for trusted clients". We're not going to remove it, we just don't want people expecting that it's safe to let people they don't trust access it over the internet.

Oh I just noticed the deprecation/pending removal message directly above in the file, so I guess we are planning to remove it. There probably isn't any need to add an extra warning in that case?

I don't know where the deprecation was decided, or if it was for security reasons. If so, we could just mention in the deprecation message that this should not be used for public-facing services and not add another warning. Otherwise, maybe the security section that immediately follows is a better place to mention it (and easier to backport, too).

There probably isn't any need to add an extra warning in that case?

Maybe some people have noticed that GCI-related functionalities will be removed in the future, but they still want to use them as a temporary solution. Therefore, I think we should still add the warning to let them know there are security issues.

If so, we could just mention in the deprecation message that this should not be used for public-facing services and not add another warning. Otherwise, maybe the security section that immediately follows is a better place to mention it (and easier to backport, too).

Currently, the warning is just below the deprecation message, and in the CGI handler section. I think it should be okay. And I think it should be a warning, so the actual page will show a red block, and it will be more noticeable. In the future, this CGI section can be wholly deleted and easily backported.

LGTM, let me know when you're happy to merge.

Thanks for the review! I think this change is ready to merge.

Thanks @aisk for the PR, and @zooba for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12.
🐍🍒⛏🤖

Sorry, @aisk and @zooba, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker dac8ff4c401f75e65a5eef1514f2d7987e63bbfe 3.12

Sorry, @aisk and @zooba, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker dac8ff4c401f75e65a5eef1514f2d7987e63bbfe 3.11

GH-116235 is a backport of this pull request to the 3.12 branch.

GH-116236 is a backport of this pull request to the 3.11 branch.

Sorry, as you pointed out, these changes introduced a conflict during the backport 😂. I resolved it manually.

Thanks! Merged now