This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new 3bd0663201 Review "Send an Allow header with the 405 response from
HttpServlet"
3bd0663201 is described below
commit 3bd0663201673ee2c6219ef22e3e4c3bf40baf78
Author: Mark Thomas <[email protected]>
AuthorDate: Fri Oct 23 19:27:39 2026 +0100
Review "Send an Allow header with the 405 response from HttpServlet"
- Don't override an application provided Allow header
---
java/javax/servlet/http/HttpServlet.java | 9 +++++++--
java/org/apache/catalina/servlets/DefaultServlet.java | 1 -
webapps/docs/changelog.xml | 5 +++++
3 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/java/javax/servlet/http/HttpServlet.java
b/java/javax/servlet/http/HttpServlet.java
index 666cc7571c..4fb47ba129 100644
--- a/java/javax/servlet/http/HttpServlet.java
+++ b/java/javax/servlet/http/HttpServlet.java
@@ -301,7 +301,10 @@ public abstract class HttpServlet extends GenericServlet {
resp.sendError(HttpServletResponse.SC_BAD_REQUEST, msg);
} else {
// RFC 9110, section 15.5.6: a 405 response must include an Allow
header field
- resp.setHeader("Allow", getAllowHeaderValue(req));
+ // Don't override an Allow header field the application may have
set
+ if (!resp.containsHeader("Allow")) {
+ resp.setHeader("Allow", getAllowHeaderValue(req));
+ }
resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED, msg);
}
}
@@ -415,7 +418,9 @@ public abstract class HttpServlet extends GenericServlet {
* OPTIONS request determines which HTTP methods the server supports and
returns an appropriate header. For example,
* if a servlet overrides <code>doGet</code>, this method returns the
following header:
* <p>
- * <code>Allow: GET, HEAD, TRACE, OPTIONS</code>
+ * <code>Allow: GET, HEAD, OPTIONS</code>
+ * <p>
+ * The TRACE method may also be present depending on container
configuration.
* <p>
* There's no need to override this method unless the servlet implements
new HTTP methods, beyond those implemented
* by HTTP 1.1.
diff --git a/java/org/apache/catalina/servlets/DefaultServlet.java
b/java/org/apache/catalina/servlets/DefaultServlet.java
index 980ddd83da..77368a41fb 100644
--- a/java/org/apache/catalina/servlets/DefaultServlet.java
+++ b/java/org/apache/catalina/servlets/DefaultServlet.java
@@ -593,7 +593,6 @@ public class DefaultServlet extends HttpServlet {
*/
@Override
protected void doOptions(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
-
resp.setHeader("Allow", determineMethodsAllowed(req));
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 7188f88447..5c4be8a2f4 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -255,6 +255,11 @@
when parsed instead of throwing an ISE, since a request remains
functionally coherent. (remm)
</fix>
+ <fix>
+ Include an <code>Allow</code> header when <code>HttpServlet</code>
sends
+ a 405 response. Based on pull request <pr>1103</pr> by Arturo Bernal.
+ (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
