https://bz.apache.org/bugzilla/show_bug.cgi?id=64507
--- Comment #3 from abernal <[email protected]> --- Checked against current trunk (9b3a3c69fb) with mod_allowmethods ("AllowMethods GET HEAD OPTIONS" in a Directory). The reported symptom does not reproduce: the 405 responses do carry an Allow header, as Ruediger described (ap_send_error_response adds it for 405 and 501). The value is wrong, though. In that directory: POST/PUT/DELETE -> 405, "Allow: TRACE" OPTIONS -> 200, "Allow: POST,OPTIONS,HEAD,GET,TRACE" The first should list the allowed methods (GET, HEAD, OPTIONS), and the second advertises POST, which the same configuration rejects. Cause: am_check_access() only sets r->allowed, but make_allow() in http_protocol.c builds the header from r->allowed_methods, which is still empty at that point in the access checker phase. OPTIONS gets the standard methods from the default handler. The module should fill r->allowed_methods (e.g. ap_allow_methods()). I will follow up separately on the incorrect value; this report as filed is not reproducible. -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
