[
https://issues.apache.org/jira/browse/KUDU-3625?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18097899#comment-18097899
]
Jason Romero commented on KUDU-3625:
------------------------------------
Fixed as part of [https://gerrit.cloudera.org/#/c/24545/]
{{Webserver::RunPathHandler()}} returns 405 with an {{Allow: GET, HEAD}} header
for any handler registered with {{{}StyleMode::STYLED{}}}, which covers all web
UI paths ({{{}/{}}}, {{{}/tables{}}}, {{{}/masters{}}},
{{{}/tablet-servers{}}}, etc. — confirmed via {{{}master_path_handlers.cc{}}}).
Verified locally against a running master:
{code:java}
curl -X POST http://<master>:<port>/ → 405, Allow: GET, HEAD
curl -X POST http://<master>:<port>/tables → 405, Allow: GET, HEAD {code}
The underlying mechanism is covered generically by HttpMethodRestrictionTest in
webserver-test.cc, which tests RunPathHandler's STYLED-mode restriction
directly against the Webserver class rather than a specific server. There's no
dedicated test file for master_path_handlers.cc itself, so master-specific UI
paths aren't independently asserted in an automated test (those were checked
manually with commands like the above ones).
Closing the ticket.
> Implement HTTP Method Error Handling for Non-GET Requests on Web UI Paths
> -------------------------------------------------------------------------
>
> Key: KUDU-3625
> URL: https://issues.apache.org/jira/browse/KUDU-3625
> Project: Kudu
> Issue Type: Bug
> Reporter: Gabriella Lotz
> Assignee: Jason Romero
> Priority: Major
>
> Currently, the web server UI pages ("/", "/tables" etc.) return a 200 OK
> response regardless of the HTTP method used. However, these pages should only
> accept GET requests. Other HTTP methods (e.g., POST, PUT, DELETE) should
> return a 405 Method Not Allowed response to avoid unintended interactions.
> Example on google.com a POST request returns this error:
> {code:java}
> 405. That's an error. The request method POST is inappropriate for the URL /.
> That's all we know.{code}
> Similarly, an appropriate 405 Method Not Allowed response should be returned
> for non-GET requests on the web UI pages.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
