apache / apache/grails-core

RestfulController is not returning 405 (Method Not Allowed) when using allowedMethods attribute to block PUT and POST in update action

Open
#10,720 2 comments 0 reactions 0 assignees View on GitHub
info: workaround available
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

In Grails 3.2.11 the default allowed methods in RestfulController are:

```
static allowedMethods = [save: "POST", update: ["PUT", "POST"], patch: "PATCH", delete: "DELETE"]
```

Trying to override this behavior to allow only PATCH requests when updating is not returning
405 (Method Not Allowed) as it supposed to do like when we use simple controllers. It keeps allowing PUT requests.

### Steps to Reproduce

- [ ] Create a simple domain
- [ ] Create a controller that extends RestfulController for the created domain
- [ ] Override allowedMethods to block some HTTP method
- [ ] Create the URL mapping in UrlMappings
- [ ] Run the application
- [ ] Create the resource
- [ ] Update the resource using PUT

```
class Message {

String text

}
```
```
class MessageController extends RestfulController {

MessageController() {
super(Message)
}
}
```
```
class MessageController extends RestfulController {

static allowedMethods = [
save: 'POST',
update: 'PATCH',
delete: 'DELETE'
]

MessageController() {
super(Message)
}
}
```
```
// UrlMappings
...

'/messages'(resources: 'message')

...
```
```
curl -X POST \
http://localhost:8080/messages \
-H 'content-type: application/json' \
-d '{
"text": "Hello, World!"
}'
```
```
curl -X PUT \
http://localhost:8080/messages/1 \
-H 'content-type: application/json' \
-d '{
"text": "Hello, World!!!!!"
}'
```

### Expected Behaviour

Return 405 (Method Not Allowed) as when working with simple controllers.

### Actual Behaviour

The request is processed normaly.

### Environment Information

- **Operating System**: macOS Sierra 10.12.4
- **Grails Version:** 3.2.11
- **JDK Version:** 1.8.0_121

Contributor guide

Open the contributing guide

Research direction

Start by inspecting RestfulController's allowedMethods handling and the UrlMappings resource entry for '/messages'. Reproduce the PUT request after restricting update to PATCH, then verify that disallowed PUT and POST requests return 405 while PATCH still updates the resource.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.