Someone is spamming my site with HEAD requests and they are causing exceptions. I don't care much about the spamming, I'm more interested in why the request fails. It turns out for a normal GET request, the matched route parameters are copied into the request as attributes in the RouteMiddleware. The ImplicitHeadMiddleware runs after the RouteMiddleware and it tries to match the request again as a HEAD request, however it doesn't copy the matched route parameters into the request. This causes the handler to load it as a GET request, but it doesn't get the parameters and thus throws exceptions. I could check for an existing id but without a valid id, the GET route wouldn't be matched anyway and so shouldn't the HEAD request.
There are 2 solutions I can think of.
Always use the RouteResult to get matched parameters. But doing that, it means that modules can't be reused outside Expressive as other frameworks don't have a RouteResult.
Copy the parameters like RouteMiddleware does so the handler doesn't need to check if it is a GET or HEAD request and $request->getAttribute('id') can be used.
Unless someone has a better idea, I'll go for solution 2.
[x] Are you fixing a bug?
[x] Detail how the bug is invoked currently.
[x] Detail the original, incorrect behavior.
[x] Detail the new, expected behavior.
[x] Base your feature on the master branch, and submit against that branch.
[x] Add a regression test that demonstrates the bug, and proves the fix.
weierophinney
commented
6 years ago
Someone is spamming my site with HEAD requests and they are causing exceptions. I don't care much about the spamming, I'm more interested in why the request fails. It turns out for a normal GET request, the matched route parameters are copied into the request as attributes in the RouteMiddleware. The ImplicitHeadMiddleware runs after the RouteMiddleware and it tries to match the request again as a HEAD request, however it doesn't copy the matched route parameters into the request. This causes the handler to load it as a GET request, but it doesn't get the parameters and thus throws exceptions. I could check for an existing id but without a valid id, the GET route wouldn't be matched anyway and so shouldn't the HEAD request.
There are 2 solutions I can think of.
$request->getAttribute('id')can be used.Unless someone has a better idea, I'll go for solution 2.
masterbranch, and submit against that branch.CHANGELOG.mdentry for the fix.