arturobernalg opened a new pull request, #1103: URL: https://github.com/apache/tomcat/pull/1103
Section 15.5.6 of RFC 9110 requires an origin server to generate an `Allow` header field in a 405 response, listing the methods supported by the target resource. The 405 sent by `HttpServlet` for a method the servlet does not implement did not include one, unlike the 405 sent by `DefaultServlet`, the `TRACE` handling and JSP pages. `HttpServlet` now sets `Allow` before sending the 405, using the same value as the default `doOptions()`, which includes `TRACE` when the connector allows it. The calculation is moved to a private method that both use. The HTTP/1.0 and HTTP/0.9 case, which answers 400, is unchanged. `TestHttpServlet` has two new tests that send an unsupported method to a servlet that implements `doGet()` and to one that implements `doGet()` and `doPost()`. Without the change they fail because there is no `Allow` header. With it they pass and the header matches what OPTIONS returns for the same servlet. The related tests pass (`TestDefaultServletOptions`, `TestWebdavServlet`, `TestConnector`, `TestJspServlet`, `TestStandardWrapper`, `TestHttpServletResponseSendError` and the HTTP/2 `TestHttpServlet`) and Checkstyle reports nothing for the changed files. `CGIServlet` also sends a 405 without `Allow`. I have not changed it here because it needs a CGI test set-up. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
