fix: send REST writes as POST with a method override - #467
Merged
Conversation
Deleting a snippet fails on hosts whose firewall permits only GET and POST. The browser reports "DELETE 403 (Forbidden)" against `code-snippets/v1/snippets/`, or a severed connection, and no snippet is removed. Bulk actions fail the same way, since they delete through the same call. The admin talks to the REST API over axios and sends real DELETE and PUT verbs. Authentication is not the problem — `X-WP-Nonce` is sent, and the request is rejected before WordPress sees it, so nothing the plugin does with credentials can help. It worked before 3.10 because the old admin went through admin-post and only ever sent POST. Requests using those verbs now go out as POST naming the intended method in `X-HTTP-Method-Override`, which the REST server reads and dispatches exactly as it would have. WordPress sees an identical request; only the verb on the wire changes. Verified both ways against WordPress 7.0.4 / PHP 8.2.33 / 3.10.0 with a stand-in firewall rejecting DELETE and PUT. Before: 403 with the snippet still present. After: 200 and the snippet removed, with and without the firewall in place. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Download and install |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft — targeting
corefor 3.10.1, and the approach is worth a look before it goes further.Reported
code-snippets/v1/snippets/, deletion non-functional since updatingnet::ERR_HTTP2_PROTOCOL_ERRORwith 0 bytes on the same action — almost certainly the same cause, a firewall severing the connection instead of answering 403Cause
The admin talks to the REST API over axios and sends real
DELETEandPUTverbs. Many hosts permit only GET and POST, so the request is rejected upstream and never reaches WordPress.The first reporter suspected missing nonces or auth headers. That part isn't it —
X-WP-Nonceis sent correctly. Nothing the plugin does with credentials can help, because the request is refused before WordPress runs.It worked before 3.10 because the old admin went through admin-post and only ever sent POST. The REST rewrite introduced the verb, which is why it appears "since the update".
Change
Requests using those verbs go out as POST, naming the intended method in
X-HTTP-Method-Override.WP_REST_Server::serve_request()reads that header and dispatches the route exactly as it would have, so WordPress sees an identical request — only the verb on the wire changes. One axios request interceptor; GET and POST are untouched.Verified
Against WordPress 7.0.4 / PHP 8.2.33 / Code Snippets 3.10.0, with a stand-in firewall rejecting DELETE/PUT:
403 DELETE, snippet remains200 POST, snippet deleted200 DELETE200 POST, snippet deletedWorth discussing
Fixes #473