net/http: FileServer handles methods it does not understand

[pascaldekloe]

A DELETE gets served happily with HTTP 200 (OK) for example. The status code should be HTTP 405 (Method Not Allowed) instead, including an Allow: GET, HEAD.

The issue applies to Go versions up to 1.19 beta.

[gopherbot]

Change https://go.dev/cl/413554 mentions this issue: net/http: FileServer method check + minimal OPTIONS implementation

[jacobishao]

do you mean that it's HTTP 200 is only used for mehod GET and HEAD?

[pascaldekloe]

HTTP 200 on a DELETE means that the resource (file) has been removed @jacobishao.