_method=put ignored for xhr and xml requests

Did some more investigating on this. If an xml request is made a _method=put in the params Rack::MethodOverride is never hit. You have to add an HTTP_X_HTTP_METHOD_OVERRIDE header.

Is there is a reason why xml requests won't look at the _method param?

I have this same issue with posting JSON as the request body format. From what I could find, it seems that the check for the METHOD_OVERRIDE_PARAM_KEY (which is set to "_method") is being done on req.POST which is empty in my JSON request. Changing that req.POST check to use req.env['action_controller.request.request_parameters'] fixes the problem for me. I'm hesitant to submit this as a patch because I'm assuming it breaks the general nature of middleware that may want to avoid ActionController completely. But maybe this Rack::MethodOverride middleware comes so late in the chain it doesn't matter?

Anyway, this is around line 15 of methodoverride.rb in the bundled Rack 1.0 in Rails 2.3.2.

After thinking about it a little more, doing this change in Rack is a bad idea. I think the actual fixable issue is that ActionController::ParamsParser sets env["action_controller.request.request_parameters"] to the parsed params. But Rack sets up it's Request#POST hash based on env['rack.input'] (I think).

It seems like two things might have to change... If ActionController::ParamsParser were to set the value of env["rack.request.form_hash"] instead of env["action_controller.request.request_parameters"], AND Rack were to check if env["rack.request.form_hash"] was already from other middleware in the chain?

Forgot to mention, setting HTTP_X_HTTP_METHOD_OVERRIDE worked fine without any of my above mentioned changes as well. I think I like this better anyway.

Do you still have this problem?

Recently after upgrading to Rails 2.3.2 suddenly in place editing plugin that we use stopped working giving "only get, put and delete method allowed" when requesting JSON using PUT method.

Thanks to you guys we managed to fix it by swapping Rack::MethodOverride with the patched version provided here (see http://guides.rubyonrails.org/ra... for swapping middlewares).

But later it turned out that this problem was caused by facebooker gem that we were using - it was inserting its own Rack middleware into the stack that caused this problem - updating it to 1.0.25 fixed this problem and we could remove our patched version of Rack::MethodOverride middleware.

I'm hitting up against this too, however, this just started happening when I created a metal app.

http://gist.github.com/115937

At first I thought it might be related to the paths I've defined in my metal app, but even if I just declare a bare bones metal app(i.e., class MyMetalApp;end;) all restful update actions are broken and I get this error:

Only get, put, and delete requests are allowed.

This seems to be the only ticket related to this issue. Not sure if I should file a new one.

Forgot to mention this is happening for standard text/html requests.

I've also stumbled into this problem when we upgraded our product to Rails version 2.3.2. It's a worry, because our app utilizes XML extensively.

This is also an issue when adding PUT links in active_scaffold

I'm having the same problem here with XHR requests. I'm working on developing the gwt-on-rails plugin, but we don't seem to be able to PUT anything as it's simply being ignored via either XHR JSON or XML requests.

Fwiw, the actual request header to send is called X-Http-Method-Override. So in curl, to simulate a JSON PUT request that would be:

curl -H "X-Http-Method-Override: put" -H "Content-Type: application/json" -d "{blah@example.com"}}"">user www.example.com/users/username.json

Took me a few hours of research. Including _method in the JSON hash had no effect whatsoever though.

Neeraj,

Those work for html requests, but if you try a JSON request _method=PUT param will fail. Although, sending the header HTTP_X_HTTP_METHOD_OVERRIDE=put does work for xhr.

Mike, how are you doing the request? Only POST requests will have their method overridden. Also the _put variable needs to be in the form data and not the query string. This is the simple Rack middleware that does the overriding:

module Rack
  class MethodOverride
    HTTP_METHODS = %w(GET HEAD PUT POST DELETE OPTIONS)

    METHOD_OVERRIDE_PARAM_KEY = "_method".freeze
    HTTP_METHOD_OVERRIDE_HEADER = "HTTP_X_HTTP_METHOD_OVERRIDE".freeze

    def initialize(app)
      @app = app
    end

    def call(env)
      if env["REQUEST_METHOD"] == "POST"
        req = Request.new(env)
        method = req.POST[METHOD_OVERRIDE_PARAM_KEY] ||
          env[HTTP_METHOD_OVERRIDE_HEADER]
        method = method.to_s.upcase
        if HTTP_METHODS.include?(method)
          env["rack.methodoverride.original_method"] = env["REQUEST_METHOD"]
          env["REQUEST_METHOD"] = method
        end
      end

      @app.call(env)
    end
  end
end

As you can see it's not a complicated bit of code so the way you build your JSON request is probably triggering the error. I think previously in the pre-Rack days the _method could either be in the query or the form data and that tends to catch people out.

This is still an issue with 3.0.6 and query parameters with method=put for ajax requests. I just ran into this today with porting 2.x code to the 3.x version of a site. using jQuery.post to a URL that includes ?mthod=put&... does not get treated as a PUT request, but as a POST.

By changing the call from $.post to $.ajax with type 'PUT' this seems to resolve the issue.