lacking support for the OPTIONS method; comments on TRACE
Opened this issue · 1 comments
OPTIONS is now the last method (of those I'm aware of and which should be supported) which has not been implemented
if anyone grabs this issue before me (I probably won't get around to it before the weekend) please keep in mind that it's much less trivial than PUT, DELETE, PATCH -- e.g. we should respond to requests such as OPTIONS *
I think we should also discuss whether responses to OPTIONS should be composed manually in the Command functions, using the additional headers parameter of httpSuccess(), or whether when Commands are added to the WebServer the methods should be registered, so that we'd have the full list available for OPTIONS * and could also handle responses to OPTIONS requests outside the Commands themselves making life easier for developers
also I would want to take this opportunity to state that IMHO we should NOT support TRACE as it has been proven to open security holes, e.g. exposure of authentication data
OPTIONS is useful for CORS support since it's used to pre-flight requests. We probably should have a compile flag indicating if cross-browser requests are supported.