codeconsole commented on PR #16146:
URL: https://github.com/apache/grails-core/pull/16146#issuecomment-5300692731
I really don't like the idea of circumventing the Dispatcher servlet and
parsing the multipart upstream all to get the `HiddenHttpMethodFilter` This
is a lot of infrastructure code just for `HiddenHttpMethodFilter`.
It was a legacy workaround. Should we even be using it anymore??? We should
at least explore disabling it by default like Spring.
The convention (originally Rails') is: the form POSTs with a hidden
_method=PUT field, and a filter wraps the request so getMethod() returns PUT.
That's what <g:form method="PUT"> and `<g:uploadForm resource="book"
action="update"` emit, and it's how Grails' scaffolded RESTful forms work.
Spring has one — and Boot turns it off
`org.springframework.web.filter.HiddenHttpMethodFilter` exists in spring-web
7.0.8. But Boot's own configuration metadata says:
```
name: spring.mvc.hiddenmethod.filter.enabled
default: False
```
Spring Boot ships it disabled. It's been off by default since Boot 2.2 — the
reasoning at the time being that it's a legacy workaround, browsers aren't the
dominant client any more, and anything using fetch/XHR can just send the real
method.
Grails, by contrast, registers its own version enabled by default, and
Grails' version is broader: it accepts any method and also honours the
X-HTTP-Method-Override header, where Spring's is narrower.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
