net/http: add Server.OptionsHandler to allow custom handling of OPTIONS * #41773

simonmittag · 2020-10-03T22:43:16Z

What version of Go are you using (`go version`)?

1.15.2

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (`go env`)?

go env Output

GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/simonmittag/Library/Caches/go-build"
GOENV="/Users/simonmittag/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/simonmittag/projects/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/simonmittag/projects/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/opt/go/libexec"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/opt/go/libexec/pkg/tool/darwin_amd64"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/fx/nx1t7v3s6xjc55_tvv1fkwgw0000gn/T/go-build132638656=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

Global options requests are described here: https://tools.ietf.org/html/rfc7231#page-31

   An OPTIONS request with an asterisk ("*") as the request-target
   (Section 5.3 of [RFC7230]) applies to the server in general rather
   than to a specific resource.

Run this request against an instance of golang http.Server (I'm using this one: https://github.com/simonmittag/j8a/blob/master/server.go), like so:

curl -v -X OPTIONS --request-target '*' --http1.1 https://j8a.io

What did you see?

A canned response from net.http built-in serverHandler, bypassing any handlers I specify.

> OPTIONS * HTTP/1.1
> Host: j8a.io
> User-Agent: curl/7.72.0
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Content-Length: 0
< Date: Sat, 03 Oct 2020 22:13:13 GMT

What did you expect to see?

Would like to customise the server response to this request and include "Allow" HTTP headers to limit the global HTTP methods made available by the server instance. However response for this request is hardcoded into net/http serverHandler: https://github.com/golang/go/blob/master/src/net/http/server.go, line 2859 which overrides handler with the built-in globalOptionsHandler

func (sh serverHandler) ServeHTTP(rw ResponseWriter, req *Request) {
	handler := sh.srv.Handler
	if handler == nil {
		handler = DefaultServeMux
	}
	if req.RequestURI == "*" && req.Method == "OPTIONS" {
		handler = globalOptionsHandler{}
	}
	handler.ServeHTTP(rw, req)
}

Can you allow users to specify this handler as an argument to http.Server?

server := &http.Server{
    GlobalOptionsHandler: myHandler,
}

The text was updated successfully, but these errors were encountered:

ianlancetaylor · 2020-10-14T16:52:36Z

CC @bradfitz @neild

bradfitz · 2020-10-14T17:14:23Z

Adding Server.GlobalOptionsHandler (perhaps drop Global ... just OptionsHandler) sounds good to me.

rsc · 2020-10-21T17:20:48Z

This is a pretty niche thing but seems small enough. Does anyone object to adding this?

rsc · 2020-10-28T17:28:26Z

Based on the discussion, this seems like a likely accept.

rsc · 2020-11-04T18:11:16Z

No change in consensus, so accepted.

simonmittag · 2021-01-05T20:42:32Z

@rsc what happens with this proposal now that it has been accepted? Do you accept pull requests? Anything I can do to help get this implemented, please let me know.

odeke-em · 2021-03-07T22:41:06Z

@simonmittag thank you for this feature request, and congrats on having it accepted. Thanks Russ, Ian, Brad and the proposal review committee for the review!

Yes we do accept Pull Requests as well as Change Lists (CLs). If using PRs, please read https://golang.org/doc/contribute#sending_a_change_github, and sign the Google CLA and then you'll be set. The resource is a good place to start https://golang.org/doc/contribute. Once you have submitted the change, please let me know and myself and other reviewers will take a look. Thank you, and I look forward to having you as a new Go contributor!

Fixes golang#41773

gopherbot · 2021-10-16T11:23:38Z

Change https://golang.org/cl/356409 mentions this issue: net/http: add Server.OptionsHandler for custom handling of OPTIONS *

…IONS * Fixes golang#41773

gopherbot · 2021-10-16T15:55:19Z

Change https://golang.org/cl/356410 mentions this issue: net/http: add Server.DisableOptionsHandler for custom handling of OPTIONS *

AlexanderYastrebov · 2021-10-16T15:59:54Z

Adding Server.GlobalOptionsHandler (perhaps drop Global ... just OptionsHandler) sounds good to me.

I've implemented Server.OptionsHandler as suggested and now think it is better to have a simple flag to disable default OPTIONS * handling and pass options requests to the main Handler, see https://golang.org/cl/356410

AlexanderYastrebov · 2021-10-20T17:48:37Z

Interesting related comment #26918 (comment) that possibly explains how default OPTIONS * handling got there in the first place.

simonmittag · 2022-01-23T21:52:56Z

Interesting related comment #26918 (comment) that possibly explains how default OPTIONS * handling got there in the first place.

I agree that separate OPTIONS * handling is warranted, and the proposed alternative implementation also works. Personally would have preferred a customisable handler over a global boolean flag. Has this been slated for release yet?

simonmittag · 2022-06-13T21:18:51Z

Wanted to bump this issue and ask if we can expect this in an upcoming release of go?

… of OPTIONS * Fixes golang#41773

dex80526 · 2022-08-11T16:54:05Z

We need this feature to allow us disabling OPTIONS method. When will this change be available? Thanks!

… of OPTIONS * Fixes golang#41773

simonmittag · 2022-08-15T22:51:55Z

is this slated for a release yet? I could also really use this feature.

seankhliao · 2022-08-16T00:21:01Z

Go follows the release cycle as described in https://go.dev/s/release

gopherbot · 2022-11-15T00:35:55Z

Change https://go.dev/cl/450515 mentions this issue: doc/go1.20: add release notes for net/http and net/http/httputil

For #41773 For #41773 For #50465 For #51914 For #53002 For #53896 For #53960 For #54136 For #54299 Change-Id: I729d5eafc1940d5706f980882a08ece1f69bb42c Reviewed-on: https://go-review.googlesource.com/c/go/+/450515 Auto-Submit: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com>

simonmittag mentioned this issue Oct 3, 2020

Support OPTIONS * HTTP/1.1 to expose J8a's supported HTTP methods simonmittag/j8a#78

Closed

simonmittag changed the title ~~Allow customised response to global 'OPTIONS *' request to http.Server~~ proposal: Allow customised response to global 'OPTIONS *' request to http.Server Oct 3, 2020

gopherbot added this to the Proposal milestone Oct 3, 2020

gopherbot added the Proposal label Oct 3, 2020

ianlancetaylor added this to Incoming in Proposals (old) Oct 14, 2020

rsc changed the title ~~proposal: Allow customised response to global 'OPTIONS *' request to http.Server~~ proposal: net/http: add Server.OptionsHandler to allow custom handling of OPTIONS * Oct 14, 2020

rsc moved this from Incoming to Active in Proposals (old) Oct 14, 2020

rsc mentioned this issue Oct 17, 2020

proposal: review meeting minutes #33502

Open

rsc moved this from Active to Likely Accept in Proposals (old) Oct 28, 2020

rsc added the Proposal-FinalCommentPeriod label Oct 28, 2020

rsc moved this from Likely Accept to Accepted in Proposals (old) Nov 4, 2020

rsc changed the title proposal: net/http: add Server.OptionsHandler to allow custom handling of OPTIONS * net/http: add Server.OptionsHandler to allow custom handling of OPTIONS * Nov 4, 2020

rsc added the Proposal-Accepted label Nov 4, 2020

rsc modified the milestones: Proposal, Backlog Nov 4, 2020

AlexanderYastrebov added a commit to AlexanderYastrebov/go that referenced this issue Oct 16, 2021

net/http: add Server.OptionsHandler for custom handling of OPTIONS *

51d6444

Fixes golang#41773

AlexanderYastrebov mentioned this issue Oct 16, 2021

net/http: add Server.OptionsHandler for custom handling of OPTIONS * #49013

Closed

AlexanderYastrebov added a commit to AlexanderYastrebov/go that referenced this issue Oct 16, 2021

net/http: add Server.DisableOptionsHandler for custom handling of OPT…

1f8ff36

…IONS * Fixes golang#41773

AlexanderYastrebov mentioned this issue Oct 16, 2021

net/http: add Server.DisableOptionsHandler for custom handling of OPTIONS * #49014

Closed

AlexanderYastrebov added a commit to AlexanderYastrebov/go that referenced this issue Jun 15, 2022

net/http: add Server.DisableGeneralOptionsHandler for custom handling…

8db0c20

… of OPTIONS * Fixes golang#41773

AlexanderYastrebov added a commit to AlexanderYastrebov/go that referenced this issue Jun 15, 2022

net/http: add Server.DisableGeneralOptionsHandler for custom handling…

12ba967

… of OPTIONS * Fixes golang#41773

AlexanderYastrebov added a commit to AlexanderYastrebov/go that referenced this issue Aug 14, 2022

net/http: add Server.DisableGeneralOptionsHandler for custom handling…

57d1ee2

… of OPTIONS * Fixes golang#41773

gopherbot closed this as completed in 05ff045 Aug 15, 2022

neild modified the milestones: Backlog, Go1.20 Aug 16, 2022

neild removed the Proposal-FinalCommentPeriod label Aug 16, 2022

prattmic mentioned this issue Dec 6, 2022

api: audit for Go 1.20 #57126

Closed

golang locked and limited conversation to collaborators Nov 15, 2023

gopherbot added the FrozenDueToAge label Nov 15, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

net/http: add Server.OptionsHandler to allow custom handling of OPTIONS * #41773

net/http: add Server.OptionsHandler to allow custom handling of OPTIONS * #41773

simonmittag commented Oct 3, 2020 •

edited

ianlancetaylor commented Oct 14, 2020

bradfitz commented Oct 14, 2020

rsc commented Oct 21, 2020

rsc commented Oct 28, 2020

rsc commented Nov 4, 2020

simonmittag commented Jan 5, 2021 •

edited

odeke-em commented Mar 7, 2021

gopherbot commented Oct 16, 2021

gopherbot commented Oct 16, 2021

AlexanderYastrebov commented Oct 16, 2021

AlexanderYastrebov commented Oct 20, 2021

simonmittag commented Jan 23, 2022

simonmittag commented Jun 13, 2022

dex80526 commented Aug 11, 2022

simonmittag commented Aug 15, 2022

seankhliao commented Aug 16, 2022

gopherbot commented Nov 15, 2022

net/http: add Server.OptionsHandler to allow custom handling of OPTIONS * #41773

net/http: add Server.OptionsHandler to allow custom handling of OPTIONS * #41773

Comments

simonmittag commented Oct 3, 2020 • edited

What version of Go are you using (go version)?

Does this issue reproduce with the latest release?

What operating system and processor architecture are you using (go env)?

What did you do?

What did you see?

What did you expect to see?

ianlancetaylor commented Oct 14, 2020

bradfitz commented Oct 14, 2020

rsc commented Oct 21, 2020

rsc commented Oct 28, 2020

rsc commented Nov 4, 2020

simonmittag commented Jan 5, 2021 • edited

odeke-em commented Mar 7, 2021

gopherbot commented Oct 16, 2021

gopherbot commented Oct 16, 2021

AlexanderYastrebov commented Oct 16, 2021

AlexanderYastrebov commented Oct 20, 2021

simonmittag commented Jan 23, 2022

simonmittag commented Jun 13, 2022

dex80526 commented Aug 11, 2022

simonmittag commented Aug 15, 2022

seankhliao commented Aug 16, 2022

gopherbot commented Nov 15, 2022

simonmittag commented Oct 3, 2020 •

edited

What version of Go are you using (`go version`)?

What operating system and processor architecture are you using (`go env`)?

simonmittag commented Jan 5, 2021 •

edited