PATCH, PUT, and DELETE Methods

[ibnesayeed]

Find "in the wild" examples of domains that supports PATCH, PUT, or DELETE methods. You can find up to three examples from different domains, one for each method.

[calebkbrad]

On an options request, the netflix.com allow header has both PUT and DELETE.

~$ curl -IL -X OPTIONS -A "Mozilla" https://netflix.com
HTTP/2 200
content-length: 0
access-control-allow-origin: *
access-control-allow-credentials: true
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, SCRIPT
access-control-allow-methods: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, SCRIPT
access-control-allow-headers: Authorization,Content-Type,Content-Encoding,Accept,X-Netflix.application.name,X-Netflix.application.version,X-Netflix.esn,X-Netflix.device.type,X-Netflix.certification.version,X-Netflix.request.uuid,X-Netflix.originating.request.uuid,X-Netflix.user.id,X-Netflix.oauth.consumer.key,X-Netflix.oauth.token,X-Netflix.ichnaea.request.type,X-Netflix.Request.Routing,X-NETFLIX-PREAPP-PARTNER-ID, X-NETFLIX-PREAPP-INTEGRITY-VALUE, X-Netflix.Request.Priority,X-Netflix.Retry.Client.Policy,X-Netflix.Client.Request.Name,X-Netflix.Request.Retry.Policy,X-Netflix.Request.Retry.Policy.Default,X-Netflix.request.client.user.guid,X-Netflix.Request.NonJson.Headers,X-Netflix.esnPrefix,X-Netflix.browserName,X-Netflix.browserVersion,X-Netflix.osName,X-Netflix.osVersion,X-Netflix.uiVersion,X-Netflix.clientType,X-NETFLIX-PERSONALIZATION-ID,X-NETFLIX-DET-TOKEN,X-NETFLIX-DET-PARTNER-PAI,X-NETFLIX-RESPONSE-OVERRIDDEN,X-NETFLIX-DET-DEPRECATION,X-Netflix.context.locales,X-Netflix.context.ui-flavor,X-Netflix.context.app-version,X-Netflix.context.schema-variant,X-Netflix.Request.toplevel.uuid,f9hi42t,6kw0ty,83fl5s0,j39egs,i1ht0d,d12e19
access-control-expose-headers: X-Netflix.Retry.Server.Policy,X-Netflix.Response.Tag,X-Netflix.Geo.Info,X-Netflix.request.inbound.identity.changed,Via,X-Netflix.Retry.Server.Policy.retryAfterSeconds,X-Netflix.Retry.Server.Policy.maxRetries,X-Ftl-Error,X-Netflix.uiVersion
via: 2 i-016fddb31e6d20dc6 (us-east-1)
server: nq_website_nonmember-prod-release UNKNOWN
x-xss-protection: 1; mode=block; report=https://www.netflix.com/ichnaea/log/freeform/xssreport
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-originating-url: http://netflix.com/
set-cookie: nfvdid=BQFmAAEBEMOONBx7JZStgWiwc7lt4XlAUcmsna-7EAlGuFTXd4O1odebNgKZcdggGRUUP-y5KXUEoWt_WYct7ALodsX5PUa17w8a5ksyAr_nuziW8YItcA%3D%3D; Domain=.netflix.com; Path=/; Max-Age=31536000
set-cookie: SecureNetflixId=v%3D2%26mac%3DAQEAEQABABQ-R19WpaCm8qh9FieUGlPu_blb7E1ZX7g.%26dt%3D1669864165358; Domain=.netflix.com; Expires=Fri, 1 Dec 2023 03:09:25 GMT; Path=/; HttpOnly; Secure; SameSite=Strict
set-cookie: NetflixId=v%3D2%26ct%3DBQAOAAEBEMrQXGMy6zlhGn0EN3AgewyBAM04eFbJyzN1HpyZWBOggb3Pjoeif27eg73Q3j-dHUpYksEhQA6sCua-mdn0mqRk8rIai89rofQl3WtfOVLSDfVaGzobVynsdyl1bXzY503q9fa9qTqIQSLwkSdVrFDvQ6V2IuBpm_DpyHIyzS_iTyJ9gG4QB-HbWgDjeQ46jS37xSsgJkFecxGWbTaSIVL1_uKLhSZ1yQiMlq7ZQ-p947vV70ZOrMzFIH1nbhrOM4UggxP0s97jiha6ikZ0_9sz14_Fa5KCQb6QtAFnO9_8fqmbMAveUh9ynIRjDYFkNh-MSdWRO-ROBKGFAKCZugZHh0dbklgT8dafMpQ25rWM4m4.%26bt%3Ddev%26mac%3DAQEAEAABABQIhxoKdke8xdWEQS_Sn0RWWL7Rc326U1Y.; Domain=.netflix.com; Expires=Fri, 1 Dec 2023 03:09:25 GMT; Path=/; HttpOnly; Secure; SameSite=Lax
x-netflix.nfstatus: 1_1
set-cookie: memclid=8c55df55-28fa-4c41-ace1-1812ac3fce92; Max-Age=31536000; Expires=Fri, 01 Dec 2023 03:09:25 GMT; Path=/; Domain=.netflix.com
x-netflix.proxy.execution-time: 5

[calebkbrad]

On an options request, this site return an "access-control-allow-methods" header with PATCH, PUT, and DELETE methods.

~$ curl -IL -X OPTIONS -A "Mozilla" https://www.wunderground.com/
HTTP/2 204
server-timing: intid;desc=c12a7044977b71b6
access-control-allow-origin: *
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
vary: Access-Control-Request-Headers
strict-transport-security: max-age=15724800; includeSubDomains
cache-control: max-age=300
expires: Thu, 01 Dec 2022 03:56:05 GMT
date: Thu, 01 Dec 2022 03:51:05 GMT
set-cookie: speedpin=4G; expires=Thu, 01-Dec-2022 04:21:05 GMT; path=/; domain=.wunderground.com; secure
set-cookie: ci=TWC-Connection-Speed=4G&TWC-Locale-Group=US&TWC-Device-Class=desktop&X-Origin-Hint=wu-next-prod&TWC-Network-Type=wifi&TWC-GeoIP-Country=US&TWC-GeoIP-Lat=36.9786&TWC-GeoIP-Long=-76.4284&Akamai-Connection-Speed=1000+&TWC-Privacy=usa-va&TWC-GeoIP-DMA=544&TWC-GeoIP-City=HAMPTON&TWC-GeoIP-Region=VA; path=/; domain=.wunderground.com; secure
property-id: TWC-WU-Prod
twc-privacy: usa-va
twc-geoip-region: VA
twc-geoip-city: HAMPTON
twc-geoip-dma: 544
twc-geoip-latlong: 36.9786,-76.4284
twc-geoip-country: US
twc-device-class: desktop
twc-locale-group: US
twc-connection-speed: 4G
x-origin-hint: wu-next-prod

[calebkbrad]

On a head request, this amazon.com resource produces an allow header with PUT and DELETE methods

~$ curl -I https://www.amazon.com/oc/dash-replenishment-service
HTTP/2 405
server: Server
date: Fri, 02 Dec 2022 04:26:45 GMT
content-type: text/html;charset=UTF-8
x-frame-options: SAMEORIGIN
x-amz-rid: YA60H3SB6AD4E17KZZ69
cache-control: no-cache
pragma: no-cache
expires: -1
allow: GET, POST, PUT, DELETE
vary: Accept-Encoding,User-Agent,Content-Type,Accept-Encoding,User-Agent
strict-transport-security: max-age=47474747; includeSubDomains; preload
x-served-by: cache-iad-kiad7000031-IAD