[Bug 64507] New: module does not send Allow: header

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=64507

            Bug ID: 64507
           Summary: module does not send Allow: header
           Product: Apache httpd-2
           Version: 2.5-HEAD
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: mod_allowmethods
          Assignee: bugs@httpd.apache.org
          Reporter: thijs@debian.org
  Target Milestone: ---

The module's goal is to send a 405 Method Not Allowed reponse when a method is
not in the whitelist of allowed methods for this path.

The HTTP spec requires that with such a 405 response, a "Allow:" header must be
sent with the response indicating which methods are supported. But the module
does not do that.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Allow

It seems that the module would have the information available to populate this
required header.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 64507] module does not send Allow: header

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=64507

--- Comment #3 from abernal <ab...@apache.org> ---
Checked against current trunk (9b3a3c69fb) with mod_allowmethods ("AllowMethods
GET HEAD OPTIONS" in a Directory).

The reported symptom does not reproduce: the 405 responses do carry an Allow
header, as Ruediger described (ap_send_error_response adds it for 405 and 501).

The value is wrong, though. In that directory:

  POST/PUT/DELETE -> 405, "Allow: TRACE"
  OPTIONS         -> 200, "Allow: POST,OPTIONS,HEAD,GET,TRACE"

The first should list the allowed methods (GET, HEAD, OPTIONS), and the second
advertises POST, which the same configuration rejects.

Cause: am_check_access() only sets r->allowed, but make_allow() in
http_protocol.c builds the header from r->allowed_methods, which is still empty
at that point in the access checker phase. OPTIONS gets the standard methods
from the default handler.

The module should fill r->allowed_methods (e.g. ap_allow_methods()). I will
follow up separately on the incorrect value; this report as filed is not
reproducible.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 64507] module does not send Allow: header

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=64507

--- Comment #1 from Ruediger Pluem <rp...@apache.org> ---
Do you have an example request that behaves wrong? The module does not set the
Allow header itself. This is taken care of by the http module and
ap_send_error_response (search for Allow).

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 64507] module does not send Allow: header

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=64507

Rich Bowen <rb...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |WONTFIX
             Status|NEW                         |RESOLVED

--- Comment #2 from Rich Bowen <rb...@apache.org> ---
Thank you for your report. As part of an effort to clean up our issue tracker,
we are closing tickets that have seen no activity for more than 5 years. If
this issue is still relevant to a current version of Apache httpd (2.4.x or
trunk), please reopen this ticket or open a new one with updated information.
We appreciate your contribution to the project.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org