One of our configurations includes the following snippet:

acl allowed_method method HEAD GET POST PUT PATCH DELETE OPTIONS
ttp-request deny if !allowed_method

In HAproxy 2.2.2 and below, this correctly blocks all requests that are not
HEAD, GET, PUT, POST, PATCH, DELETE, or OPTIONS.

In HAproxy 2.2.3, this blocks PATCH requests. It seems to *only* be broken
for PATCH requests.

The word "PATCH" does not occur in the diff between 2.2.2 and 2.2.3, which
is concerning.

-- 
James Brown
Engineer

Reply via email to