codeinchaos/restful-zend-framework — Issue #3: RESTful Controllers return error 405 on HTTP OPTIONS call
Author: tbrannam
Created: 2012-01-12 14:17:15+00:00
State: open

I'm implementing a server that is to support CORS (Cross Origin Resource Sharing) - I have the initial setup working under Chrome and Safari for Macintosh, but Firefox never makes it past the HTTP OPTIONS check. It is not clear to me why the REST_Controller::optionsAction unconditionally returns a 405 error instead of 200.

I would expect that optionsAction really should be looking at Access-Control-Request-Method and the URI. For example (from below) the Request-Method is GET and the URI is /api/preferences -- I would think that if access control grants GET to /api/preferences that a 200 result would be sent back. When blindly returning 200, it resolves the issue with Firefox on Mac.

Is there something in the OPTIONS rfc that I have missed regarding error 405?

-- request

OPTIONS /api/preferences?format=json&_=1326321312010 HTTP/1.1
Host	api.foobar.com
User-Agent	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:9.0.1) Gecko/20100101 Firefox/9.0.1
Accept	text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,application/json
Accept-Language	en-us,en;q=0.5
Accept-Encoding	gzip, deflate
Accept-Charset	ISO-8859-1,utf-8;q=0.7,*;q=0.7
Origin	http://foobar.com
Access-Control-Request-Method	GET
Access-Control-Request-Headers	authorization,x-requested-with

-- response

HTTP/1.1 405 Method Not Allowed
Date: Wed, 11 Jan 2012 22:35:12 GMT
Server: Apache
X-Powered-By: PHP/5.3.6
Vary: Accept
Allow: INDEX, GET, POST, PUT, DELETE, HEAD, OPTIONS
Access-Control-Allow-Origin: http://foobar.com
Access-Control-Allow-Headers: X-Requested-With
Access-Control-Allow-Headers: Authorization
Access-Control-Allow-Headers: Origin
Access-Control-Allow-Methods: GET
Access-Control-Allow-Methods: INDEX
Access-Control-Allow-Methods: OPTIONS
Content-Length: 0
Content-Type: application/json