2

I'm using an Apache (2.2) rewrite rule to whitelist a number of HTTP methods:

RewriteEngine on
RewriteCond %{REQUEST_METHOD} !^(GET|HEAD|DELETE|PUT|POST)$
RewriteRule ^(.*)$ - [F,L]

This works well, and rejects unwanted methods:

curl -X ACL -v http://localhost/my-page/
* About to connect() to localhost port 80 (#0)
*   Trying 127.0.0.1... connected
> ACL /my-page/ HTTP/1.1
> User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
> Accept: */*
> Host: localhost
> 
< HTTP/1.1 403 Forbidden
< Date: Fri, 18 Jul 2014 16:15:29 GMT
< Server: Apache
< Vary: Accept-Encoding
< Content-Length: 217
< Content-Type: text/html; charset=iso-8859-1

I thought it would be nice to change the rewrite to send out a "405 - method not allowed" response:

RewriteEngine on
RewriteCond %{REQUEST_METHOD} !^(GET|HEAD|DELETE|PUT|POST)$
RewriteRule ^(.*)$ - [R=405,L]

However, with this simple change in place, I now get a spurious empty Allow header in my response:

curl -X ACL -v http://localhost/my-page/
* About to connect() to localhost port 80 (#0)
*   Trying 127.0.0.1... connected
> ACL /my-page/ HTTP/1.1
> User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
> Accept: */*
> Host: localhost
> 
< HTTP/1.1 405 Method Not Allowed
< Date: Fri, 18 Jul 2014 16:18:37 GMT
< Server: Apache
< Allow: 
< Vary: Accept-Encoding
< Content-Length: 236
< Content-Type: text/html; charset=iso-8859-1

Why is Apache inserting this header? I'm trying to use "SetEnvIf / Header add" to send a valid Allow header, in which case I end up with 2 Allow headers. Can I get rid of the empty Allow header somehow, or perhaps arrange for it to be correctly populated?

  • I've voted +1 on your question because even if i think i know why Apache add this header, i spend half a day trying to set its value, with no luck... – krisFR Jul 19 '14 at 18:59
  • @krisFR - I'd be interested to hear your theory on why Apache is adding the header! :) – Robin Jul 19 '14 at 21:33
  • It is defined in RFC 2616 regarding HTTP/1.1protocol : An Allow header field MUST be present in a 405 (Method Not Allowed) response. So Apache just respects this. Check section 14.7 here for details – krisFR Jul 19 '14 at 21:37
0

Wait is frustrating is Apache adds the header, sure, the RFC says they need to. But Apache adds an EMPTY header, when the RFC says they should list the methods which should work.

By the RFC, Allow: with NO methods listed, as Apache creates, means no method at all can work.

Luckily, very few clients pay attention to the Allow header, be it from OPTIONS, or as part of the required 405, or (as suggeted but not required) as part of 501.

The reason nobody users OPTIONS or pays attention to the Allow header is it's very rare (as in almost never) to see them properly implemented. And, as with Apache, difficult, if not impossible, for a web designer to convince the server to do it right.

Frankly, it's such a mess, the IETF missed the boat with the new RFC for HTTP. what they should have done is codify existing practice by deprecating the Allow header, explaining that servers will do whatever they want, clients should ignore them, and the whole mess should be forgotten.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.