This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 7ff4eabc9d Review "Send an Allow header with the 405 response from
HttpServlet"
7ff4eabc9d is described below
commit 7ff4eabc9dc50b97132b8ed1f37f91b21605782c
Author: Mark Thomas <[email protected]>
AuthorDate: Fri Oct 23 19:27:39 2026 +0100
Review "Send an Allow header with the 405 response from HttpServlet"
- Don't override an application provided Allow header
- Correct DefaultServlet's allow for PATCH and QUERY
---
java/jakarta/servlet/http/HttpServlet.java | 9 +++++++--
java/org/apache/catalina/servlets/DefaultServlet.java | 17 +++++++++++++++++
webapps/docs/changelog.xml | 9 +++++++++
3 files changed, 33 insertions(+), 2 deletions(-)
diff --git a/java/jakarta/servlet/http/HttpServlet.java
b/java/jakarta/servlet/http/HttpServlet.java
index 0e31f4b136..51bf4666f3 100644
--- a/java/jakarta/servlet/http/HttpServlet.java
+++ b/java/jakarta/servlet/http/HttpServlet.java
@@ -395,7 +395,10 @@ public abstract class HttpServlet extends GenericServlet {
resp.sendError(HttpServletResponse.SC_BAD_REQUEST, msg);
} else {
// RFC 9110, section 15.5.6: a 405 response must include an Allow
header field
- resp.setHeader("Allow", getAllowHeaderValue(req));
+ // Don't override an Allow header field the application may have
set
+ if (!resp.containsHeader("Allow")) {
+ resp.setHeader("Allow", getAllowHeaderValue(req));
+ }
resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED, msg);
}
}
@@ -528,7 +531,9 @@ public abstract class HttpServlet extends GenericServlet {
* OPTIONS request determines which HTTP methods the server supports and
returns an appropriate header. For example,
* if a servlet overrides <code>doGet</code>, this method returns the
following header:
* <p>
- * <code>Allow: GET, HEAD, TRACE, OPTIONS</code>
+ * <code>Allow: GET, HEAD, OPTIONS</code>
+ * <p>
+ * The TRACE method may also be present depending on container
configuration.
* <p>
* There's no need to override this method unless the servlet implements
new HTTP methods, beyond those implemented
* by HTTP 1.1.
diff --git a/java/org/apache/catalina/servlets/DefaultServlet.java
b/java/org/apache/catalina/servlets/DefaultServlet.java
index 3ddc4dbb6b..42b363de21 100644
--- a/java/org/apache/catalina/servlets/DefaultServlet.java
+++ b/java/org/apache/catalina/servlets/DefaultServlet.java
@@ -571,8 +571,25 @@ public class DefaultServlet extends HttpServlet {
*/
@Override
protected void doOptions(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
+ resp.setHeader("Allow", determineMethodsAllowed(req));
+ }
+
+ @Override
+ protected void doPatch(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
+ // Overridden so the correct Allow header can be returned
+ resp.setHeader("Allow", determineMethodsAllowed(req));
+ // Picks up HttpServlet's HTTP/1.0 handling
+ super.doPatch(req, resp);
+ }
+
+
+ @Override
+ protected void doQuery(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
+ // Overridden so the correct Allow header can be returned
resp.setHeader("Allow", determineMethodsAllowed(req));
+ // Picks up HttpServlet's HTTP/1.0 handling
+ super.doQuery(req, resp);
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 9139d0f081..78792b2c70 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -446,6 +446,15 @@
when parsed instead of throwing an ISE, since a request remains
functionally coherent. (remm)
</fix>
+ <fix>
+ Include an <code>Allow</code> header when <code>HttpServlet</code>
sends
+ a 405 response. Based on pull request <pr>1103</pr> by Arturo Bernal.
+ (markt)
+ </fix>
+ <fix>
+ Ensure the DefaultServlet returns the correct Allow header for
+ <code>PATCH</code> and <code>QUERY</code> requests. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
