Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork9.7k
[HttpFoundation] drop support for HTTP method override for GET, HEAD, CONNECT and TRACE requests#62042
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Conversation
xabbuh commentedOct 11, 2025
| Q | A |
|---|---|
| Branch? | 8.0 |
| Bug fix? | no |
| New feature? | yes |
| Deprecations? | no |
| Issues | |
| License | MIT |
| $method =strtoupper($method); | ||
| if (\in_array($method, ['GET','HEAD','CONNECT','TRACE'],true)) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I wonder if we should forbid (in 7.4) listing any of these methods in$allowedHttpMethodOverride
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
And return a 400?
I wondered the same and thought: what for in the end?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I was thinking of throwing an exception ifsetAllowedHttpMethodOverride() is called with a list of methods of which one or more are matching this list.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Ah, yes, that'd work for me, to spot misconfigs earlier
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
see#62065
Thank you@xabbuh. |
b6d7b24 intosymfony:8.0Uh oh!
There was an error while loading.Please reload this page.
…rride of GET, HEAD, CONNECT and TRACE (xabbuh)This PR was merged into the 7.4 branch.Discussion----------[FrameworkBundle][HttpFoundation] forbid HTTP method override of GET, HEAD, CONNECT and TRACE| Q | A| ------------- | ---| Branch? | 7.4| Bug fix? | no| New feature? | no| Deprecations? | no| Issues | see#62042 (comment)| License | MITCommits-------1b79380 forbid HTTP method override of GET, HEAD, CONNECT and TRACE