This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 20fcb5d5a225faabe6e789df1bfb9bfe057f19a8 Author: Mark Thomas <[email protected]> AuthorDate: Fri Oct 23 19:27:39 2026 +0100 Review "Send an Allow header with the 405 response from HttpServlet" - Don't override an application provided Allow header - Correct DefaultServlet's allow for PATCH and QUERY --- java/jakarta/servlet/http/HttpServlet.java | 9 +++++++-- java/org/apache/catalina/servlets/DefaultServlet.java | 17 +++++++++++++++++ webapps/docs/changelog.xml | 9 +++++++++ 3 files changed, 33 insertions(+), 2 deletions(-) diff --git a/java/jakarta/servlet/http/HttpServlet.java b/java/jakarta/servlet/http/HttpServlet.java index ee176020c1..1acee1cc8f 100644 --- a/java/jakarta/servlet/http/HttpServlet.java +++ b/java/jakarta/servlet/http/HttpServlet.java @@ -368,7 +368,10 @@ public abstract class HttpServlet extends GenericServlet { resp.sendError(HttpServletResponse.SC_BAD_REQUEST, msg); } else { // RFC 9110, section 15.5.6: a 405 response must include an Allow header field - resp.setHeader("Allow", getAllowHeaderValue(req)); + // Don't override an Allow header field the application may have set + if (!resp.containsHeader("Allow")) { + resp.setHeader("Allow", getAllowHeaderValue(req)); + } resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED, msg); } } @@ -492,7 +495,9 @@ public abstract class HttpServlet extends GenericServlet { * OPTIONS request determines which HTTP methods the server supports and returns an appropriate header. For example, * if a servlet overrides <code>doGet</code>, this method returns the following header: * <p> - * <code>Allow: GET, HEAD, TRACE, OPTIONS</code> + * <code>Allow: GET, HEAD, OPTIONS</code> + * <p> + * The TRACE method may also be present depending on container configuration. * <p> * There's no need to override this method unless the servlet implements new HTTP methods, beyond those implemented * by HTTP 1.1. diff --git a/java/org/apache/catalina/servlets/DefaultServlet.java b/java/org/apache/catalina/servlets/DefaultServlet.java index 47d471d899..f4c48d753f 100644 --- a/java/org/apache/catalina/servlets/DefaultServlet.java +++ b/java/org/apache/catalina/servlets/DefaultServlet.java @@ -584,8 +584,25 @@ public class DefaultServlet extends HttpServlet { */ @Override protected void doOptions(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { + resp.setHeader("Allow", determineMethodsAllowed(req)); + } + + @Override + protected void doPatch(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { + // Overridden so the correct Allow header can be returned + resp.setHeader("Allow", determineMethodsAllowed(req)); + // Picks up HttpServlet's HTTP/1.0 handling + super.doPatch(req, resp); + } + + + @Override + protected void doQuery(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { + // Overridden so the correct Allow header can be returned resp.setHeader("Allow", determineMethodsAllowed(req)); + // Picks up HttpServlet's HTTP/1.0 handling + super.doQuery(req, resp); } diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml index 4c56ea8986..38f8c5b9a4 100644 --- a/webapps/docs/changelog.xml +++ b/webapps/docs/changelog.xml @@ -266,6 +266,15 @@ when parsed instead of throwing an ISE, since a request remains functionally coherent. (remm) </fix> + <fix> + Include an <code>Allow</code> header when <code>HttpServlet</code> sends + a 405 response. Based on pull request <pr>1103</pr> by Arturo Bernal. + (markt) + </fix> + <fix> + Ensure the DefaultServlet returns the correct Allow header for + <code>PATCH</code> and <code>QUERY</code> requests. (markt) + </fix> </changelog> </subsection> <subsection name="Coyote"> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
