Repository navigation
Conversation
Member
|
LGTM |
|
Many thanks for the PR! @apolukhin is now importing your pull request into our internal upstream repository. |
TRACE is a standard HTTP method (RFC 9110 9.3.8) that llhttp parses fine, but server::http::HttpMethod had no value for it: an incoming TRACE was mapped to kUnknown and routing answered 405, and "TRACE" in a handler 'method:' list threw at service start. Add kTrace to the enum, to the string conversions, to the llhttp mapping and to kHandlerMethods, so a handler can register for TRACE and receive it like any other method. Answering with the RFC message/http loopback echo stays up to the handler - the framework only needs to be able to route the method. HTTP/2 takes the method from the ':method' pseudo-header rather than from llhttp, so it is covered by a separate functional test.
Mirrors the server-side TRACE support in clients::http::HttpMethod, so the enum and HttpMethodFromString() cover the same set of methods on both sides. TRACE carries no request body, so it is sent as a custom request just like DELETE and OPTIONS.
SSE4
force-pushed
the
trace-http-method
branch
from
October 6, 2026 06:22
6b12f5d to
b706811
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The problem
server::http::HttpMethodnames every method of RFC 9110 except one. TRACEparses fine — llhttp has known
HTTP_TRACEforever — but userver maps it tokUnknown, andkUnknownis not routable. So:TRACE / HTTP/1.1gets a 405 from the routing layer, beforeany of your code runs;
TRACEin a handler'smethod:list does not help either — itthrows at service start, because
HttpMethodFromStringdoes not know thestring.
The result is not "userver denies TRACE by policy", it is "userver cannot
express TRACE at all". There is no opt-in to reach for.
When this is useful
test target previously served by nginx that answers TRACE like any other
request. Without
kTracethe userver replacement is not behaviour-compatible.(Cross-Site Tracing) checks need a backend that actually answers TRACE;
a framework-level 405 makes the rig untestable.
intermediaries did to my request" tool (RFC 9110 §9.3.8). A service that wants
to implement the loopback echo — or a deliberately trimmed version of it —
currently cannot, however much it wants to.
answer rather than whatever the framework decided on your behalf.
What changes
kTraceis added to the enum, to the string conversions, to the llhttp mappingand to
kHandlerMethods. That is all — it makes TRACE expressible:Default behaviour is unchanged. A handler that does not list
TRACEstillanswers 405, exactly as today. Nothing becomes reachable by accident, which
matters here: TRACE reflecting a credentialed request is the XST problem, and it
stays a per-handler opt-in.
Deliberately out of scope
The RFC
message/httploopback echo. Answering TRACE correctly is the handler'sbusiness, the same way userver does not auto-implement OPTIONS semantics for
you (beyond the explicit
implicit-http-optionsfallback). The framework onlyneeds to stop being unable to route the method.
The second commit
feat core: allow sending TRACE requests with the HTTP client— mirrors theaddition in
clients::http::HttpMethod, so both sides of the framework coverthe same method set and
HttpMethodFromString("TRACE")stops throwing on theclient. Separate commit; drop it if you would rather keep the change
server-side only.
Tests
Unit tests for
ToString/HttpMethodFromString/IsHandlerMethod,TRACEadded to the HTTP/1.1 parser parametrization, and a functional test in the
http2serversuite — HTTP/2 reads the method from the:methodpseudo-headerinstead of llhttp, so it is a genuinely separate path.