HTTP Methods Validation

8 tests verify that only allowed HTTP methods are accepted per path.

Configuration

HTTP methods are configured per path in the policy.yaml file:

# policy.yaml
paths:
  - pattern: "/static/*"
    methods: ["GET", "HEAD"]      # Read-only for static files

  - pattern: "/api/users"
    methods: ["GET", "POST"]      # List and create

  - pattern: "/api/users/{id}"
    methods: ["GET", "PUT", "DELETE"]  # Read, update, delete

  - pattern: "/health"
    methods: ["GET"]              # Health check only

METHOD-001PASS

GET /static/style.css - Allowed method

Sample Request

curl -X GET http://localhost:8080/static/style.css

Expected Response

HTTP/1.1 200 OK
Content-Type: text/css

/* CSS content... */

GET requests to static files are allowed as defined in the policy. The request is forwarded to the backend.

METHOD-002PASS

POST /api/users - Allowed method

Sample Request

curl -X POST -H "Content-Type: application/json" \
  -d '{"name": "John", "email": "john@example.com"}' \
  http://localhost:8080/api/users

POST requests to /api/users are allowed for creating new users.

METHOD-003BLOCKED

DELETE /static/style.css - Method not allowed

Sample Request

curl -X DELETE http://localhost:8080/static/style.css

Expected Response

HTTP/1.1 405 Method Not Allowed
Content-Type: application/json
Allow: GET, HEAD

{"error": "Method not allowed", "allowed": ["GET", "HEAD"]}

DELETE requests to static files are blocked. The response includes the Allow header listing permitted methods.

METHOD-004BLOCKED

PUT /api/users - Method not allowed

Sample Request

curl -X PUT -d '{"name": "Updated"}' http://localhost:8080/api/users

Expected Response

HTTP/1.1 405 Method Not Allowed
Allow: GET, POST

{"error": "Method not allowed", "allowed": ["GET", "POST"]}

PUT to the collection endpoint /api/users is blocked. PUT is only allowed on /api/users/{id} for updating specific resources.

METHOD-005BLOCKED

TRACE /api/users - Dangerous method blocked

Sample Request

curl -X TRACE http://localhost:8080/api/users

TRACE and other potentially dangerous methods are blocked by default to prevent XST (Cross-Site Tracing) attacks.