// The Content-type header does not make sense on GET requests, because GET
    // requests do not carry any content. Nothing to filter in this case.
    if ($request->isMethod('GET')) {
      return $collection;
    }

should be

    // The Content-type header does not make sense on GET requests, because GET
    // requests do not carry any content. Nothing to filter in this case.
    if ($request->isMethod('GET') || $request->isMethod('HEAD')) {
      return $collection;
    }

Comments

Wim Leers created an issue. See original summary.

wim leers’s picture

Priority: Normal » Major

Given it blocks contrib, bumping to major.

wim leers’s picture

Status: Active » Needs review
StatusFileSize
new932 bytes

Failing test coverage.

wim leers’s picture

StatusFileSize
new1.72 KB

The last submitted patch, 4: 2934152-3.patch, failed testing. View results

neclimdul’s picture

Makes sense. Wonder if it makes sense to include OPTIONS while we're at it though.

wim leers’s picture

StatusFileSize
new2.45 KB
new2.3 KB

Then we should probably also add TRACE.

e0ipso’s picture

This also looks good to me. Nice and simple.

+1.

dawehner’s picture

Status: Needs review » Reviewed & tested by the community

This looks fine for me, too.

wim leers’s picture

🎉

neclimdul’s picture

Status: Reviewed & tested by the community » Needs review

TRACE has a body it just can't be a method that writes to the server so I left it out. Its a weird method to support as a CMS in reality but for the sake of correctness I'm not sure its actually is correct to exclude.

wim leers’s picture

Are you sure?

https://tools.ietf.org/html/rfc7231#section-4.3.8 says:

   The TRACE method requests a remote, application-level loop-back of
   the request message.  The final recipient of the request SHOULD
   reflect the message received, excluding some fields described below,
   back to the client as the message body of a 200 (OK) response with a
   Content-Type of "message/http" (Section 8.3.1 of [RFC7230]).
…
   A client MUST NOT send a message body in a TRACE request.
neclimdul’s picture

Status: Needs review » Reviewed & tested by the community

Hmm, I must have misread something... Fair enough.

wim leers’s picture

Title: ContentTypeHeaderMatcher should not run for HEAD requests » ContentTypeHeaderMatcher should not run for GET, HEAD, OPTIONS or TRACE requests

Improving issue title.

larowlan’s picture

Crediting @neclimdul as his observations changed the shape of the patch

  • larowlan committed a46090e on 8.5.x
    Issue #2934152 by Wim Leers, neclimdul: ContentTypeHeaderMatcher should...
larowlan’s picture

Version: 8.4.x-dev » 8.5.x-dev
Status: Reviewed & tested by the community » Fixed

Committed as a46090e and pushed to 8.5.x.

As per https://www.drupal.org/core/release-cycle-overview#current-development-c... 8.4 is in 'critical fixes only', so this can't be backported to 8.4

wim leers’s picture

@larowlan: doesn't "criticals only for current minor" start when the beta of the next minor is released?

larowlan’s picture

neclimdul’s picture

I feel like I'm not understanding the policy clearly because it seems to put site devs in an awkward position not getting major bug fixes for a possibly extended-ish period of time. Is there documentation around it or is just RM consensus?

xjm’s picture

I feel like I'm not understanding the policy clearly because it seems to put site devs in an awkward position not getting major bug fixes for a possibly extended-ish period of time. Is there documentation around it or is just RM consensus?

Normally, site developers may not get bug fixes for 4-5 weeks after the fix is committed to the production branch. During the final preparation of the minor release, this is increased to up to 6-7 weeks. Not really that much of a difference in the grand scheme of things.

Also, this is indeed an official policy as documented on https://www.drupal.org/core/release-cycle-overview, and has been applied consistently from 8.1.x on.

Thanks!

neclimdul’s picture

Thanks xjm, I guess that sort of makes sense. I hate to ask this but I'd already read it twice and I just read it start to finish 3 more times and I just can't figure out what section documents this policy. Where exactly is this prep-critical policy documented?

wim leers’s picture

We're talking not 4-5 weeks, not 6-7 weeks, but 14–15 weeks (committed January 7, available April 18).

I have to agree with @neclimdul here, it's not clear to me at all where this is documented. I did see this:

February 7, 2018 8.5.0-beta1 released. Final patch release window for 8.4.x (criticals only).

… which is what I based my comment in #19 on.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.