Add "Allow" headers to 405 Method Not Allowed responses

[Kludex]

This PR was inspired based on a FastAPI issue reported by @hellocoldworld.

As we can see on the RFC 7231, responses with 405 status code MUST provide the allow headers. Starlette doesn't honor that.

What this PR introduces is a potential solution, which I'd like to discuss - to understand if it's the best solution. Changes here:

• ExceptionMiddleware adds allow headers when HTTPException.status_code == 405. (I'm not sure if this makes sense yet).
• Add allow headers when PlainResponse.status_code == 405.

There's still a case that is not being handled on this PR:

• When we have AnyResponse(status_code=405), it doesn't add the allow headers. It should, right?

Important resources:

• Click here to see Django way of handling 405 allow headers.
• Click here to see Flask way of handling 405 allow headers.

[adriangb]

Could we instead add a headers parameter to HTTPException and thus handle this in Route? I don't particularly like iterating through routes from within the middleware.

For context, FastAPI already has a subclass that does this, so that PR would also upstream their customization: https://github.com/tiangolo/fastapi/blob/291180bf2d8c39e84860c2426b1d58b6c80f6fef/fastapi/exceptions.py#L13

[Kludex]

The code will look faaaaar more clear with that. I've created #1435, as it's another issue.

But maybe none of those two PRs are needed, as we need to solve the question I asked above:

When we have AnyResponse(status_code=405), it doesn't add the allow headers. It should, right?

Should we add a NotAllowedResponse class that accepts allowed_methods? 🤔

[lovelydinosaur]

Should we add a xyz class

Default answer to this is nope, thanks. 😅

Let's not extend the API of Starlette at all if we can help it.

[lovelydinosaur]

I guess we'd may as well use standard HTTP casing here - Allow.

(Eg. I checked https://github.com/encode/starlette/blob/master/starlette/middleware/gzip.py to see what we use internally elsewhere)

[adriangb]

But maybe none of those two PRs are needed, as we need to solve the question I asked above:

When we have AnyResponse(status_code=405), it doesn't add the allow headers. It should, right?

Should we add a NotAllowedResponse class that accepts allowed_methods? 🤔

My thought was that once #1435 gets merged we'd just use that feature in Route.handle and be done with this.

I don't think we need to automagically enforce this for any response with status_code=405. I think that if Starlette itself does this when it returns a 405, that's good enough.

[Kludex]

Replaced by #1436