net/http: add Server.OptionsHandler to allow custom handling of OPTIONS *

[simonmittag]

What version of Go are you using (go version)?

1.15.2

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output

GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/simonmittag/Library/Caches/go-build"
GOENV="/Users/simonmittag/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/simonmittag/projects/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/simonmittag/projects/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/opt/go/libexec"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/opt/go/libexec/pkg/tool/darwin_amd64"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/fx/nx1t7v3s6xjc55_tvv1fkwgw0000gn/T/go-build132638656=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

Global options requests are described here: https://tools.ietf.org/html/rfc7231#page-31

   An OPTIONS request with an asterisk ("*") as the request-target
   (Section 5.3 of [RFC7230]) applies to the server in general rather
   than to a specific resource.

Run this request against an instance of golang http.Server (I'm using this one: https://github.com/simonmittag/j8a/blob/master/server.go), like so:

curl -v -X OPTIONS --request-target '*' --http1.1 https://j8a.io

What did you see?

A canned response from net.http built-in serverHandler, bypassing any handlers I specify.

> OPTIONS * HTTP/1.1
> Host: j8a.io
> User-Agent: curl/7.72.0
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Content-Length: 0
< Date: Sat, 03 Oct 2020 22:13:13 GMT

What did you expect to see?

Would like to customise the server response to this request and include "Allow" HTTP headers to limit the global HTTP methods made available by the server instance. However response for this request is hardcoded into net/http serverHandler: https://github.com/golang/go/blob/master/src/net/http/server.go, line 2859 which overrides handler with the built-in globalOptionsHandler

func (sh serverHandler) ServeHTTP(rw ResponseWriter, req *Request) {
	handler := sh.srv.Handler
	if handler == nil {
		handler = DefaultServeMux
	}
	if req.RequestURI == "*" && req.Method == "OPTIONS" {
		handler = globalOptionsHandler{}
	}
	handler.ServeHTTP(rw, req)
}

Can you allow users to specify this handler as an argument to http.Server?

server := &http.Server{
    GlobalOptionsHandler: myHandler,
}

[ianlancetaylor]

CC @bradfitz @neild

[bradfitz]

Adding Server.GlobalOptionsHandler (perhaps drop Global ... just OptionsHandler) sounds good to me.

[rsc]

This is a pretty niche thing but seems small enough. Does anyone object to adding this?

[rsc]

Based on the discussion, this seems like a likely accept.

[rsc]

No change in consensus, so accepted.

[simonmittag]

@rsc what happens with this proposal now that it has been accepted? Do you accept pull requests? Anything I can do to help get this implemented, please let me know.

[odeke-em]

@simonmittag thank you for this feature request, and congrats on having it accepted. Thanks Russ, Ian, Brad and the proposal review committee for the review!

Yes we do accept Pull Requests as well as Change Lists (CLs). If using PRs, please read https://golang.org/doc/contribute#sending_a_change_github, and sign the Google CLA and then you'll be set. The resource is a good place to start https://golang.org/doc/contribute. Once you have submitted the change, please let me know and myself and other reviewers will take a look. Thank you, and I look forward to having you as a new Go contributor!

[gopherbot]

Change https://golang.org/cl/356409 mentions this issue: net/http: add Server.OptionsHandler for custom handling of OPTIONS *

[gopherbot]

Change https://golang.org/cl/356410 mentions this issue: net/http: add Server.DisableOptionsHandler for custom handling of OPTIONS *

[AlexanderYastrebov]

Adding Server.GlobalOptionsHandler (perhaps drop Global ... just OptionsHandler) sounds good to me.

I've implemented Server.OptionsHandler as suggested and now think it is better to have a simple flag to disable default OPTIONS * handling and pass options requests to the main Handler, see https://golang.org/cl/356410

[AlexanderYastrebov]

Interesting related comment #26918 (comment) that possibly explains how default OPTIONS * handling got there in the first place.

[simonmittag]

Interesting related comment #26918 (comment) that possibly explains how default OPTIONS * handling got there in the first place.

I agree that separate OPTIONS * handling is warranted, and the proposed alternative implementation also works. Personally would have preferred a customisable handler over a global boolean flag. Has this been slated for release yet?

[simonmittag]

Wanted to bump this issue and ask if we can expect this in an upcoming release of go?

[dex80526]

We need this feature to allow us disabling OPTIONS method. When will this change be available? Thanks!

[simonmittag]

is this slated for a release yet? I could also really use this feature.

[seankhliao]

Go follows the release cycle as described in https://go.dev/s/release

[gopherbot]

Change https://go.dev/cl/450515 mentions this issue: doc/go1.20: add release notes for net/http and net/http/httputil