net/http: FileServer handles methods it does not understand

[pascaldekloe]

A DELETE gets served happily with HTTP 200 (OK) for example. The status code should be HTTP 405 (Method Not Allowed) instead, including an Allow: GET, HEAD.

The issue applies to Go versions up to 1.19 beta.

[gopherbot]

Change https://go.dev/cl/413554 mentions this issue: net/http: FileServer method check + minimal OPTIONS implementation

[jacobishao]

do you mean that it's HTTP 200 is only used for mehod GET and HEAD?

[pascaldekloe]

HTTP 200 on a DELETE means that the resource (file) has been removed @jacobishao.

[dr2chase]

@neild can you give this and the corresponding CL a look? It looks plausible to me but IANAE.

[dr2chase]

Or perhaps @rsc could give it a look?

[gopherbot]

Change https://go.dev/cl/482635 mentions this issue: Revert "net/http: FileServer method check + minimal OPTIONS implementation"

[gopherbot]

Change https://go.dev/cl/488635 mentions this issue: [release-branch.go1.20] Revert "net/http: FileServer method check + minimal OPTIONS implementation"