Exclude CONNECT from allowed HTTP methods

Updated initAllowedHttpMethods in WebContentGenerator and RequestMappingInfoHandlerMapping to explicitly exclude the CONNECT method.
spring-projects · Jan 5, 2025 · b224fea · b224fea
1 parent 18106b3
commit b224fea
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/...ain/java/org/springframework/web/servlet/mvc/method/RequestMappingInfoHandlerMapping.java b/...ain/java/org/springframework/web/servlet/mvc/method/RequestMappingInfoHandlerMapping.java
@@ -517,7 +517,7 @@ private static Set<HttpMethod> initAllowedHttpMethods(Set<String> declaredMethod
 			Set<HttpMethod> result = CollectionUtils.newLinkedHashSet(declaredMethods.size());
 			if (declaredMethods.isEmpty()) {
 				for (HttpMethod method : HttpMethod.values()) {
-					if (method != HttpMethod.TRACE) {
+					if (method != HttpMethod.TRACE && method != HttpMethod.CONNECT) {
 						result.add(method);
 					}
 				}

diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/support/WebContentGenerator.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/support/WebContentGenerator.java
@@ -146,7 +146,7 @@ private void initAllowHeader() {
 		if (this.supportedMethods == null) {
 			allowedMethods = new ArrayList<>(HttpMethod.values().length - 1);
 			for (HttpMethod method : HttpMethod.values()) {
-				if (method != HttpMethod.TRACE) {
+				if (method != HttpMethod.TRACE && method != HttpMethod.CONNECT) {
 					allowedMethods.add(method.name());
 				}
 			}