RestfulController is not returning 405 (Method Not Allowed) when using allowedMethods attribute to block PUT and POST in update action
- Dominant language
- Groovy
- Stars
- 2.9k
- Forks
- 975
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 92
Description
In Grails 3.2.11 the default allowed methods in RestfulController are:
```
static allowedMethods = [save: "POST", update: ["PUT", "POST"], patch: "PATCH", delete: "DELETE"]
```
Trying to override this behavior to allow only PATCH requests when updating is not returning
405 (Method Not Allowed) as it supposed to do like when we use simple controllers. It keeps allowing PUT requests.
### Steps to Reproduce
- [ ] Create a simple domain
- [ ] Create a controller that extends RestfulController for the created domain
- [ ] Override allowedMethods to block some HTTP method
- [ ] Create the URL mapping in UrlMappings
- [ ] Run the application
- [ ] Create the resource
- [ ] Update the resource using PUT
```
class Message {
String text
}
```
```
class MessageController extends RestfulController {
MessageController() {
super(Message)
}
}
```
```
class MessageController extends RestfulController {
static allowedMethods = [
save: 'POST',
update: 'PATCH',
delete: 'DELETE'
]
MessageController() {
super(Message)
}
}
```
```
// UrlMappings
...
'/messages'(resources: 'message')
...
```
```
curl -X POST \
http://localhost:8080/messages \
-H 'content-type: application/json' \
-d '{
"text": "Hello, World!"
}'
```
```
curl -X PUT \
http://localhost:8080/messages/1 \
-H 'content-type: application/json' \
-d '{
"text": "Hello, World!!!!!"
}'
```
### Expected Behaviour
Return 405 (Method Not Allowed) as when working with simple controllers.
### Actual Behaviour
The request is processed normaly.
### Environment Information
- **Operating System**: macOS Sierra 10.12.4
- **Grails Version:** 3.2.11
- **JDK Version:** 1.8.0_121
Contributor guide
Research direction
Start by inspecting RestfulController's allowedMethods handling and the UrlMappings resource entry for '/messages'. Reproduce the PUT request after restricting update to PATCH, then verify that disallowed PUT and POST requests return 405 while PATCH still updates the resource.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- groovy
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100