StaticFiles 405 responses are missing the Allow header

[sungbin1015]

StaticFiles answers non-GET/HEAD requests with 405 Method Not Allowed but without an Allow header, while Route and HTTPEndpoint include one.

import tempfile

from starlette.applications import Starlette
from starlette.responses import PlainTextResponse
from starlette.routing import Mount, Route
from starlette.staticfiles import StaticFiles
from starlette.testclient import TestClient

directory = tempfile.mkdtemp()
with open(f"{directory}/a.txt", "w") as f:
    f.write("x")

app = Starlette(
    routes=[
        Route("/r", lambda request: PlainTextResponse("x")),
        Mount("/static", StaticFiles(directory=directory)),
    ]
)
client = TestClient(app)
for url in ("/r", "/static/a.txt"):
    response = client.post(url)
    print(url, response.status_code, response.headers.get("allow"))

/r 405 HEAD, GET
/static/a.txt 405 None

RFC 9110 §15.5.6 says the origin server MUST generate an Allow header in a 405 response. #1436 added it for Route and HTTPEndpoint; StaticFiles raises its own HTTPException(status_code=405) in get_response and was not covered.

Environment: Starlette main at ff5b4df, Python 3.11, Linux.

The fix is one line (headers={"Allow": "GET, HEAD"}) plus an assertion in the existing test_staticfiles_post. I have it ready and will open a PR referencing this discussion; happy to adjust or drop it if you'd rather handle it differently.

I searched open and closed issues, PRs and discussions for StaticFiles + Allow / 405 and found nothing covering it (#3585 is about HEAD in HTTPEndpoint's Allow value and only touches endpoints.py).

[aashish254]

you're right, it's missing. in staticfiles.py get_response raises a bare HTTPException(status_code=405) with no headers, while Route sets Allow from its methods. rfc 9110 says a 405 must include an Allow header so this looks like an oversight.

fix would be headers={"Allow": "GET, HEAD"} on that raise. worth opening as an issue or PR if you want it fixed upstream.