-
-
Notifications
You must be signed in to change notification settings - Fork 9.6k
[HttpFoundation] Add OPTIONS and TRACE to the list of safe methods #19321
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
👍 |
b7a24e2
to
85253e5
Compare
public function methodProvider() | ||
{ | ||
return array( | ||
array(Request::METHOD_HEAD, true), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
to be consistent with comments on other PRs, shouldn't we use plain strings here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
👍
Comments fixed. |
Thank you @dunglas. |
… methods (dunglas) This PR was squashed before being merged into the 2.7 branch (closes #19321). Discussion ---------- [HttpFoundation] Add OPTIONS and TRACE to the list of safe methods | Q | A | ------------- | --- | Branch? | 2.7 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | n/a | License | MIT | Doc PR | n/a According to [RFC 7231](https://tools.ietf.org/html/rfc7231#section-8.1.3) `OPTIONS` and `TRACE` are safe methods. Commits ------- 1404607 [HttpFoundation] Add OPTIONS and TRACE to the list of safe methods
The reasoning is RFC conformance. OPTIONS and TRACE are safe methods according to the specs. |
The relevant quote of RFC 7231: Of the request methods defined by this specification, the GET, HEAD, |
…e (xabbuh) This PR was merged into the 2.7 branch. Discussion ---------- [HttpFoundation] no 304 response if method is not cacheable | Q | A | ------------- | --- | Branch? | 2.7 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | | License | MIT | Doc PR | Since #19321 OPTIONS and TRACE are considered safe methods. But both methods should not lead to "304 Not modified" responses. Commits ------- 3d6b450 no 304 response if method is not cacheable
According to RFC 7231
OPTIONS
andTRACE
are safe methods.