rails/rails — pull request #9032 by michiels (2013-01-22 20:39:45+00:00)
Title: Make HEAD work / convert to GET once more

While testing a Rails 4 app in semi-production, I noticed that CSRF protection threw exceptions on HEAD requests by crawler bots.

TDLR: Shall I make a pull request that adds support for a HEAD request in the csrf protection code? Should we find a way to convert HEAD -> GET just like in Rails <4.

After discovering, I read in the CHANGELOG that `ActionDispatch::Head` was replaced in favor of `Rack::Head` by Aaron Paterson. `ActionDispatch::Head` converted a HEAD to a GET request like so:

```ruby
def call(env)
if env["REQUEST_METHOD"] == "HEAD"
env["REQUEST_METHOD"] = "GET"
env["rack.methodoverride.original_method"] = "HEAD"
status, headers, _ = @app.call(env)
[status, headers, []]
else
@app.call(env)
end
end
```

However. `Rack::Head` middleware does not do this HEAD -> GET conversion in https://github.com/rack/rack/blob/master/lib/rack/head.rb.

```ruby
if env["REQUEST_METHOD"] == "HEAD"
body.close if body.respond_to? :close
[status, headers, []]
else
[status, headers, body]
end
```

We could easily add a `request.head?` in `valid_request?` to support this. But somehow I feel there are more reasons and code that depends on HEAD requests being converted to GETs.

Added a failing test for now.