4 ms·
> So Rails (along with some other web frameworks) implements a clever hack: it tries to route HEAD requests to the same place as it would route GET requests. Th
by danso 7y ago
> So Rails (along with some other web frameworks) implements a clever hack: it tries to route HEAD requests to the same place as it would route GET requests. Then it runs the controller code, and just omits the response body.
I wonder if Rails will fix the default implementation of handling HEAD requests, similar to how they overhauled the default handling of mass assignment of parameters in 2012 (coincidentally, a flaw also exposed via Github) [0]? Obviously, the latter issue posed a much bigger risk to the average Rails app.
[0] https://news.ycombinator.com/item?id=3666564 https://news.ycombinator.com/item?id=3666564
edit: fixed URL
- 333c 7y agoYour link doesn't work.
- homakov 7y ago> I wonder if Rails will fix the default implementation of handling HEAD requests It absolutely should. Nobody expected Rails to covertly turn HEAD into GET. It must be explicit "get_or_head" method in routes.rb
- michaelmior 7y agoHEAD isn't turned into GET, it's routed the same as a GET request. If it were actually turned into a GET request, then `request.get?` would have been true, and this exploit wouldn't have happened. But I do agree with your point that routing of HEAD requests should be explicit.
- homakov 7y ago> HEAD isn't turned into GET, it's routed the same as a GET request Pardon my poor wording indeed, I intended to mean this too.
- ptoomey3 7y agoRails actually did turn the HEAD into a GET back when this code was written - https://github.com/rails/rails/blob/e17e25cd23e8abd45b1706463dd57c90fa6dcb7c/actionpack/lib/action_dispatch/middleware/head.rb#L8-L9 https://github.com/rails/rails/blob/e17e25cd23e8abd45b170646...
- FanaHOVA 7y agoConsidering that GitHub is one the main Rails maintainers, probably. That might actually be how they fixed it internally and will push it upstream.
- jessaustin 7y agoISTM it's reasonable not to force everyone not to write a separate HEAD handler everywhere. The main result of that would be lots of 405 errors. This was a really dumb mistake at the application level. Maybe the library needs better documentation, but it shouldn't be made less functional.
- latortuga 7y agoAgreed. This is a corner case because Rails encourages you to route different request verbs to different endpoints via the `resource` routing scheme. The situation played out like this because of handling GET and POST via the same action which should not have been done and in general is not something Rails encourages.