3 ms·
> I wonder if Rails will fix the default implementation of handling HEAD requests It absolutely should. Nobody expected Rails to covertly turn HEAD into GET. I
by homakov 7y ago
> I wonder if Rails will fix the default implementation of handling HEAD requests
It absolutely should. Nobody expected Rails to covertly turn HEAD into GET. It must be explicit "get_or_head" method in routes.rb
- michaelmior 7y agoHEAD isn't turned into GET, it's routed the same as a GET request. If it were actually turned into a GET request, then `request.get?` would have been true, and this exploit wouldn't have happened. But I do agree with your point that routing of HEAD requests should be explicit.
- homakov 7y ago> HEAD isn't turned into GET, it's routed the same as a GET request Pardon my poor wording indeed, I intended to mean this too.
- ptoomey3 7y agoRails actually did turn the HEAD into a GET back when this code was written - https://github.com/rails/rails/blob/e17e25cd23e8abd45b1706463dd57c90fa6dcb7c/actionpack/lib/action_dispatch/middleware/head.rb#L8-L9 https://github.com/rails/rails/blob/e17e25cd23e8abd45b170646...