Skip to content

[HttpFoundation] Add OPTIONS and TRACE to the list of safe methods #19321

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from

Conversation

dunglas
Copy link
Member

@dunglas dunglas commented Jul 9, 2016

Q A
Branch? 2.7
Bug fix? yes
New feature? no
BC breaks? no
Deprecations? no
Tests pass? yes
Fixed tickets n/a
License MIT
Doc PR n/a

According to RFC 7231 OPTIONS and TRACE are safe methods.

@xabbuh
Copy link
Member

xabbuh commented Jul 9, 2016

👍

@javiereguiluz javiereguiluz changed the title [HttpFoundation] Add OTIONS and TRACE to the list of safe methods [HttpFoundation] Add OPTIONS and TRACE to the list of safe methods Jul 9, 2016
@dunglas dunglas force-pushed the update_safe_method branch from b7a24e2 to 85253e5 Compare July 9, 2016 09:17
public function methodProvider()
{
return array(
array(Request::METHOD_HEAD, true),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

to be consistent with comments on other PRs, shouldn't we use plain strings here?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@dunglas
Copy link
Member Author

dunglas commented Jul 10, 2016

Comments fixed.

@fabpot
Copy link
Member

fabpot commented Jul 10, 2016

Thank you @dunglas.

fabpot added a commit that referenced this pull request Jul 10, 2016
… methods (dunglas)

This PR was squashed before being merged into the 2.7 branch (closes #19321).

Discussion
----------

[HttpFoundation] Add OPTIONS and TRACE to the list of safe methods

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

According to [RFC 7231](https://tools.ietf.org/html/rfc7231#section-8.1.3) `OPTIONS` and `TRACE` are safe methods.

Commits
-------

1404607 [HttpFoundation] Add OPTIONS and TRACE to the list of safe methods
@fabpot fabpot closed this Jul 10, 2016
@jameshalsall
Copy link
Contributor

@dunglas what was the reasoning behind this change? it seems like a BC break to me and is causing issues like #19582

@dunglas
Copy link
Member Author

dunglas commented Aug 11, 2016

The reasoning is RFC conformance. OPTIONS and TRACE are safe methods according to the specs.

@dunglas
Copy link
Member Author

dunglas commented Aug 11, 2016

The relevant quote of RFC 7231:

Of the request methods defined by this specification, the GET, HEAD,
OPTIONS, and TRACE methods are defined to be safe.

fabpot added a commit that referenced this pull request Oct 14, 2016
…e (xabbuh)

This PR was merged into the 2.7 branch.

Discussion
----------

[HttpFoundation] no 304 response if method is not cacheable

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

Since #19321 OPTIONS and TRACE are considered safe methods. But both methods should not lead to "304 Not modified" responses.

Commits
-------

3d6b450 no 304 response if method is not cacheable
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants