This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new 80d42374a2 Review "Send an Allow header with the 405 response from
HttpServlet"
80d42374a2 is described below
commit 80d42374a2d09d5eb7945e6101a32cbbc3532ba9
Author: Mark Thomas <[email protected]>
AuthorDate: Fri Oct 23 19:27:39 2026 +0100
Review "Send an Allow header with the 405 response from HttpServlet"
- Don't override an application provided Allow header
---
java/jakarta/servlet/http/HttpServlet.java | 9 +++++++--
java/org/apache/catalina/servlets/DefaultServlet.java | 1 -
webapps/docs/changelog.xml | 5 +++++
3 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/java/jakarta/servlet/http/HttpServlet.java
b/java/jakarta/servlet/http/HttpServlet.java
index 34dee9da9d..7e8fed104e 100644
--- a/java/jakarta/servlet/http/HttpServlet.java
+++ b/java/jakarta/servlet/http/HttpServlet.java
@@ -323,7 +323,10 @@ public abstract class HttpServlet extends GenericServlet {
resp.sendError(HttpServletResponse.SC_BAD_REQUEST, msg);
} else {
// RFC 9110, section 15.5.6: a 405 response must include an Allow
header field
- resp.setHeader("Allow", getAllowHeaderValue(req));
+ // Don't override an Allow header field the application may have
set
+ if (!resp.containsHeader("Allow")) {
+ resp.setHeader("Allow", getAllowHeaderValue(req));
+ }
resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED, msg);
}
}
@@ -437,7 +440,9 @@ public abstract class HttpServlet extends GenericServlet {
* OPTIONS request determines which HTTP methods the server supports and
returns an appropriate header. For example,
* if a servlet overrides <code>doGet</code>, this method returns the
following header:
* <p>
- * <code>Allow: GET, HEAD, TRACE, OPTIONS</code>
+ * <code>Allow: GET, HEAD, OPTIONS</code>
+ * <p>
+ * The TRACE method may also be present depending on container
configuration.
* <p>
* There's no need to override this method unless the servlet implements
new HTTP methods, beyond those implemented
* by HTTP 1.1.
diff --git a/java/org/apache/catalina/servlets/DefaultServlet.java
b/java/org/apache/catalina/servlets/DefaultServlet.java
index bfb2f7697a..a81249086f 100644
--- a/java/org/apache/catalina/servlets/DefaultServlet.java
+++ b/java/org/apache/catalina/servlets/DefaultServlet.java
@@ -592,7 +592,6 @@ public class DefaultServlet extends HttpServlet {
*/
@Override
protected void doOptions(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
-
resp.setHeader("Allow", determineMethodsAllowed(req));
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 74a064a01f..edbefcd6a2 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -266,6 +266,11 @@
when parsed instead of throwing an ISE, since a request remains
functionally coherent. (remm)
</fix>
+ <fix>
+ Include an <code>Allow</code> header when <code>HttpServlet</code>
sends
+ a 405 response. Based on pull request <pr>1103</pr> by Arturo Bernal.
+ (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
