expressjs / method-override Goto Github PK

After your last update on news projects i detect this error. Actually this error first show on express/lib/application.js:209:11 but later on our server file it shows on app.use(methodOverride('X-HTTP-Method-Override')); line.

AFAIK, there are at least three ways to override request method:

1. via { X-HTTP-METHOD-OVERRIDE: PUT } header
2. via ?_method=PUT
3. via req.body._method

In my not so complicated application which was built with express 3, there are two ways of them involved already. And as far as I can tell, we can't ditch NO. 2 and 3 completely unless the application we are implementing is totally asynchronized with JavaScript.

So why make the way to override exclusive?

Looking in req.body is absolutely non-standard and has a big problem where the entire request body needs to be parsed before this middleware is invoked, which doesn't make any sense. I haven't seen any other method override lib support body lookups. Really, this was just a bad decision to use req.body .i.m.o

Is the header (e.g. in methodOverride('X-HTTP-Method-Override')) case sensitive?

This module will accept the method override from any method. It should probably be restricted to only certain methods (user configurable?) like only POST (the default?). The only real purpose for this module is to allow legacy systems to make a different method call than they are capable of, and really, every client can POST and POST requests typically contain bodies, so I don't see a use-case to accept method-overrides in other methods (you can always POST with no body as well).

@jonathanong @Fishrock123 @defunctzombie thoughts?

All is fine when using the POST method. But when using PUT , req.body is empty.
And the following code structure i wrote:

Middlleware
app.use(bodyParser.urlencoded({extended: false}));
app.use(methodOverride('_method'));

HTML form
form action="/admin/edit-product/<%= product._id%>?_method=put" enctype="multipart/form-data"

Route
router.put('/edit-product/:id',function(req, res){ console.log(req.body); });

Can anyone tell me what would be the equivalent of:

<form action="/campaigns/revive/<%= revive._id %>?_method=DELETE" method="post">
    <button>Delete</button>
</form>

in pug / jade?

I've tried all I can think of to get the override to work.
In the middleware, it seems the req.method and req.originalMethod get set correctly.
However, the route doesn't fire.

Using:

• express v4.5.0
• method-override v2.0.2

Please see this stripped-down repo to recreate the issue:
https://github.com/ryanlelek/method_override_issue

It seems we could not overwrite the method with a GET request.
What if we detect in both req.body and req.query?

// req.body
    if (req.body && typeof req.body === 'object' && key in req.body) {
      method = req.body[key].toLowerCase();
      delete req.body[key];
    }

I just want to thank you. You saved me a lot of time (and headaches)
I'm building a framework on top of express and this is exactly what I needed ;)
Framework is Saturnial (name suggestions accepted)
You rock!

There should be a way to disable the check for the X-HTTP-Method-Override header (perhaps even set the name you want to check?).