haskell-servant / haskell-servant/servant

document that GET implies HEAD support

Open
#1,885 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Haskell
Stars
2k
Forks
427
Avg merge
2d 23h
Merged PRs (30d)
5

Description

I understand that is a very common expectation for many web frameworks, but I still found it surprising that my servant server, which has a StreamGet endpoint for an internal API, also supported HEAD. In my case, HEAD unfortunately exposed a denial of service bug in my code, which I didn't think to test for because I didn't know it was supported.

Looking through the docs, I have not been able to find anywhere that documents that StreamGet or Get implies HEAD support. It's mostly documented by omission, since there's no explicit Head used in example API types, and indeed no Head verb. I suggest documenting it explicitly.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.