Hacker News Reader

Comment by danso | Hacker News Reader

> So Rails (along with some other web frameworks) implements a clever hack: it tries to route HEAD requests to the same place as it would route GET requests. Then it runs the controller code, and just omits the response body.

I wonder if Rails will fix the default implementation of handling HEAD requests, similar to how they overhauled the default handling of mass assignment of parameters in 2012 (coincidentally, a flaw also exposed via Github) [0]? Obviously, the latter issue posed a much bigger risk to the average Rails app.

[0] https://news.ycombinator.com/item?id=3666564

edit: fixed URL

View on HN

> I wonder if Rails will fix the default implementation of handling HEAD requests

It absolutely should. Nobody expected Rails to covertly turn HEAD into GET. It must be explicit "get_or_head" method in routes.rb

HEAD isn't turned into GET, it's routed the same as a GET request. If it were actually turned into a GET request, then `request.get?` would have been true, and this exploit wouldn't have happened.

But I do agree with your point that routing of HEAD requests should be explicit.

> HEAD isn't turned into GET, it's routed the same as a GET request

Pardon my poor wording indeed, I intended to mean this too.

Rails actually did turn the HEAD into a GET back when this code was written - https://github.com/rails/rails/blob/e17e25cd23e8abd45b170646...

Considering that GitHub is one the main Rails maintainers, probably. That might actually be how they fixed it internally and will push it upstream.

ISTM it's reasonable not to force everyone not to write a separate HEAD handler everywhere. The main result of that would be lots of 405 errors. This was a really dumb mistake at the application level. Maybe the library needs better documentation, but it shouldn't be made less functional.

Agreed. This is a corner case because Rails encourages you to route different request verbs to different endpoints via the `resource` routing scheme. The situation played out like this because of handling GET and POST via the same action which should not have been done and in general is not something Rails encourages.

Your link doesn't work.

Reply on news.ycombinator.com