HTTP Method Security
Last updated
Last updated
More often you will find that certain web operations need to be restricted in terms of what HTTP verb is used to access a resource. For example, you do not want form submissions to be done via GET but via POST or PUT operations. HTTP Verb recognition is also essential when building strong RESTFul APIs when security is needed as well.
You can do this manually, but why do the extra coding :)
This solution is great and works, but it is not THAT great. We can do better.
Another feature property on an event handler is called this.allowedMethods
. It is a declarative structure that you can use to determine what the allowed HTTP methods are for any action on the event handler.
If the request action HTTP method is not found in the approved list, it will look for a onInvalidHTTPMethod()
on the handler and call it if found. Otherwise ColdBox throws a 405 exception that is uniform across requests.
If the action is not listed in the structure, then it means that we allow all HTTP methods. Just remember to either use the onError()
or onInvalidHTTPMethod()
method conventions or an exception handler to deal with the security exceptions.
You can tag your event actions with a allowedMethods
annotation and add a list of the allowed HTTP verbs as well. This gives you a nice directed ability right at the function level instead of a property. It is also useful when leveraging DocBox documentation as it will show up in the API Docs that are generated.
You can listen for methods using the coldbox.onInvalidHTTPMethodHandler
located in your config/ColdBox.cfc.