4 ms·
HEAD isn't turned into GET, it's routed the same as a GET request. If it were actually turned into a GET request, then `request.get?` would have been true, and
by michaelmior 7y ago
HEAD isn't turned into GET, it's routed the same as a GET request. If it were actually turned into a GET request, then `request.get?` would have been true, and this exploit wouldn't have happened.
But I do agree with your point that routing of HEAD requests should be explicit.
- homakov 7y ago> HEAD isn't turned into GET, it's routed the same as a GET request Pardon my poor wording indeed, I intended to mean this too.
- ptoomey3 7y agoRails actually did turn the HEAD into a GET back when this code was written - https://github.com/rails/rails/blob/e17e25cd23e8abd45b1706463dd57c90fa6dcb7c/actionpack/lib/action_dispatch/middleware/head.rb#L8-L9 https://github.com/rails/rails/blob/e17e25cd23e8abd45b170646...