A request with the wrong method is told the page does not exist, never 405 #234

New Issue

2026-10-16T02:59:56Z

cgalo5758 commented

2026-10-16 02:59:56 +00:00

What happens

The console registers its dashboard on the pattern / with no method (internal/server/server.go:754). Go's ServeMux answers 405 Method Not Allowed, with an Allow header, only when no registered pattern matches the request's method. A pattern with no method matches every method, and / matches every path, so that answer never comes.

A request for a real path with the wrong method therefore resolves to /. The dispatcher in front of the mux, newRouteAwareHandler (internal/server/server.go:280-289), reads a match on / for any path other than / as "no route" and renders the styled 404: "The page you requested does not exist." An HTMX request gets the plain-text 404.

The route table records this today. A POST to /domains/ask, which takes GET, and a GET to /billing/checkout, which takes POST, both answer 404 (internal/server/testdata/routes.golden:329-332).

The root path has the opposite gap. Its handler checks only the path, so a POST or a DELETE to / is served the dashboard.

What should happen

A request whose path matches a route under another method gets 405 with an Allow header naming the methods that route takes. RFC 9110, section 15.5.6, requires the header on every 405. A navigation request gets a styled 405 page and an HTMX request a plain-text one, as with 404 now. A path that no route matches under any method keeps the 404. The dashboard answers GET and HEAD only.

The dispatcher can find the allowed methods by asking the mux how it would route the same path under each method and keeping the methods whose match is not /. The error-pages spec names 404 and 500 only, so it gains 405.

Where

newRouteAwareHandler and the / handler in internal/server/server.go. TestNewHandlerRouteTable in internal/server/new_handler_test.go (rows "a POST to a GET route" and "a GET to a POST route") and its recorded answers in internal/server/testdata/routes.golden, which will change with the fix. openspec/specs/error-pages/spec.md.

Steps

Sign in to the console.
Open /billing/checkout in the browser's address bar. The page says "The page you requested does not exist."

Why it matters

The answer names the wrong cause. Someone wiring a form, a script or a proxy with the wrong method is told the path does not exist and looks for a typo in the path. A client that reads status codes cannot tell a wrong method from a missing route.

## What happens The console registers its dashboard on the pattern `/` with no method (`internal/server/server.go:754`). Go's `ServeMux` answers 405 Method Not Allowed, with an `Allow` header, only when no registered pattern matches the request's method. A pattern with no method matches every method, and `/` matches every path, so that answer never comes. A request for a real path with the wrong method therefore resolves to `/`. The dispatcher in front of the mux, `newRouteAwareHandler` (`internal/server/server.go:280-289`), reads a match on `/` for any path other than `/` as "no route" and renders the styled 404: "The page you requested does not exist." An HTMX request gets the plain-text 404. The route table records this today. A POST to `/domains/ask`, which takes GET, and a GET to `/billing/checkout`, which takes POST, both answer 404 (`internal/server/testdata/routes.golden:329-332`). The root path has the opposite gap. Its handler checks only the path, so a POST or a DELETE to `/` is served the dashboard. ## What should happen A request whose path matches a route under another method gets 405 with an `Allow` header naming the methods that route takes. RFC 9110, section 15.5.6, requires the header on every 405. A navigation request gets a styled 405 page and an HTMX request a plain-text one, as with 404 now. A path that no route matches under any method keeps the 404. The dashboard answers GET and HEAD only. The dispatcher can find the allowed methods by asking the mux how it would route the same path under each method and keeping the methods whose match is not `/`. The error-pages spec names 404 and 500 only, so it gains 405. ## Where `newRouteAwareHandler` and the `/` handler in `internal/server/server.go`. `TestNewHandlerRouteTable` in `internal/server/new_handler_test.go` (rows "a POST to a GET route" and "a GET to a POST route") and its recorded answers in `internal/server/testdata/routes.golden`, which will change with the fix. `openspec/specs/error-pages/spec.md`. ## Steps 1. Sign in to the console. 2. Open `/billing/checkout` in the browser's address bar. The page says "The page you requested does not exist." ## Why it matters The answer names the wrong cause. Someone wiring a form, a script or a proxy with the wrong method is told the path does not exist and looks for a typo in the path. A client that reads status codes cannot tell a wrong method from a missing route.

cgalo5758 added the

labels 2026-10-16 02:59:56 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wiki-cafe/member-console#234