[RFC] HTTP method overriding middleware

[corentin-larose]

• [x] I was not able to find an open or closed issue matching what I'm seeing.
• [x] This is not a question. (Questions should be asked on slack (Signup for Slack here) or our forums.)

• Case 1: In my previous company which was handling several millions of request each day on a Restful API-centric website based on Apigility, we once realised that one of our customers just didn't allow other HTTP verbs than GET and POST through his proxy.
• Case 2: Some browser still don't allow other verbs than GET and POST in forms.

I propose to create a middleware overriding the HTTP method when _method parameter is provided in the GET or POST payload (ie ?_method=DELETE).

Some options I also consider:

• Provide user with the ability to set the name of the parameter instead of the default name _method
• Provide the user with the ability to enforce that the argument has been provided in the super global ($_GET or $_POST) corresponding to the HTTP method used for the request (GET or POST)
• Provide user with the ability to decide whether argument should be removed from the query after usage (hence a cloned and modified query returned)

validateMethod has been derived from the request trait.

If interest shown, I will create the file and unit tests in a PR. Should that middleware be provided as a "module"?

<?php

declare(strict_types=1);

namespace Zend\Stratigility\Middleware;

use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;

class HttpMethodOverride implements MiddlewareInterface
{
    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler) : ResponseInterface
    {
        $method = $request->getAttribute('_method', null);

        if (!is_null($method)) {
            $this->validateMethod($method);

            $originalMethod = strtoupper($request->getMethod());

            switch ($originalMethod) {
                case 'GET':
                case 'POST':
                    $request = $request->withMethod(strtoupper($method));
                    break;
                default:
                    throw new InvalidArgumentException(sprintf(
                        'Only GET and POST http methods can be overrode, received %s',
                        $method
                    ));
            }
        }

        return $handler->handle($request);
    }

    /**
     * Validate the HTTP method
     *
     * @param null|string $method
     * @throws InvalidArgumentException on invalid HTTP method.
     */
    private function validateMethod($method)
    {
        if (! is_string($method)) {
            throw new InvalidArgumentException(sprintf(
                'Unsupported HTTP method; must be a string, received %s',
                (is_object($method) ? get_class($method) : gettype($method))
            ));
        }

        if (! preg_match('/^[!#$%&\'*+.^_`\|~0-9a-z-]+$/i', $method)) {
            throw new InvalidArgumentException(sprintf(
                'Unsupported HTTP method "%s" provided',
                $method
            ));
        }
    }
}

[weierophinney]

Honestly, I think this would have general utility for any PSR-7/PSR-15 middleware application, not just Stratigility. Have you considered shipping it as a standalone package?

[corentin-larose]

Hello,

Yes, this is what I wanted to say when writing "Should that middleware be provided as a "module"?". Ok, I will create a standalone package and come back to you guys for comments. What do you think about the configuration options I proposed? I will also come back with a standalone port of my zf-http-cache module.

[corentin-larose]

Then, trying to find a repository to put that codeI just found this: https://github.com/middlewares/method-override. So I close this issue

[weierophinney]

Awesome to see it already exists! Make sure to contribute to it if you find it is missing functionality you need. :smile: