Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 09:15 UTC
fileserver: Reject non-GET/HEAD requests (close #5166) (#5167)
* fileserver: Reject non-GET/HEAD requests (close #5166) * Set Allow header according to RFC 9110 10.2.1
Matt Holt committed
Oct 24, 2022 at 10:23 UTC
a3ae146cbdf2cfbdbdf5feea52e8bf407cce2b31
1 file changed
+8
modules/caddyhttp/fileserver/staticfiles.go
+8
@@ -410,6 +410,14 @@ func (fsrv *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request, next c
410
etag = calculateEtag(info)
411
}
412
413
+ // at this point, we're serving a file; Go std lib supports only
414
+ // GET and HEAD, which is sensible for a static file server - reject
415
+ // any other methods (see issue #5166)
416
+ if r.Method != http.MethodGet && r.Method != http.MethodHead {
417
+ w.Header().Add("Allow", "GET, HEAD")
418
+ return caddyhttp.Error(http.StatusMethodNotAllowed, nil)
419
+ }
420
+
421
// set the Etag - note that a conditional If-None-Match request is handled
422
// by http.ServeContent below, which checks against this Etag value
423
w.Header().Set("Etag", etag)