question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

pages ignore HTTP method -- is this desirable?

See original GitHub issue

I recently noticed that SvelteKit matches pages on path alone and ignores the HTTP method. For example, if you create routes/foo.svelte, you can GET, POST, PUT, or DELETE to /foo and the rendered response is the same. This may be intentional, but it’s pretty surprising, so it should at least be documented.

One complication of the current implementation is that the HTTP method and request body (for example POSTed form data) are not made visible to load. They’re available in handle, so someone could pass them along via context pretty easily if they wanted to. On the other hand, if someone wants to globally restrict pages to GET only (which seems sensible for many use cases), I don’t see an easy way to do that currently, because handle doesn’t know if it’s going to render a page or an endpoint.

I’m creating this issue to bring attention to this (unintentional?) design feature and start more discussion about it. I don’t really have a strong opinion on how to address it other than to document it better. And it would be nice if load had more visibility into the request without needing custom code in handle. (It would also be possible to fix things by only matching pages on GET, but that’s probably unnecessarily restrictive.)

Issue Analytics

  • State:closed
  • Created 2 years ago
  • Comments:9 (6 by maintainers)

github_iconTop GitHub Comments

2reactions
Rich-Harriscommented, Apr 22, 2021

It veers slightly into magical territory. I think I’d prefer that we just document that pages will respond to any method, and if you want to handle non-GETs sensibly then you need a shadowing endpoint with a fallthrough

1reaction
Conduitrycommented, Sep 20, 2021

@goynang Take a look at #1711.

Read more comments on GitHub >

github_iconTop Results From Across the Web

HTTP/1.1: Method Definitions
These methods ought to be considered "safe". This allows user agents to represent other methods, such as POST, PUT and DELETE, in a...
Read more >
HTTP request methods - MDN Web Docs
Chrome Edge CONNECT Full support. ChromeYes. Toggle history Full support. Edge12. Toggle history DELETE Full support. ChromeYes. Toggle history Full support. Edge12. Toggle history GET Full...
Read more >
HTTP OPTIONS and Default page vulnerabilities
Simple ways for fixing HTTP OPTIONS and Default page vulnerabilities. ... Follow the steps below to disable OPTIONS method.
Read more >
Why your Website is giving an HTTP 405 Method Not Allowed ...
HTTP 405 is not something that you should ignore. It happens for a reason and usually indicates a problem with your site or...
Read more >
K34769490: Blocking HTTP OPTIONS method in HTTP requests
Impact of procedure: When you set the Unknown Method setting to Reject, all unknown methods are rejected; this is not limited to HTTP...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found