Explicitly reject methods that are not GET or POST

diff --git a/src/getPrf.js b/src/getPrf.js
index 264fe3cf07627a1f943e31b55377737ffcbd761a..c46e4139b4e10b21fc1a271daa4bc1c5197f6c99 100644 (file)
--- a/src/getPrf.js
+++ b/src/getPrf.js
@@ -164,6 +164,11 @@ export async function getPrf(options = {}) {
         return;
       });
     }
+    // Explicitly reject all other methods
+    else {
+      response.writeHead(400).end();
+      return;
+    }
   });
 
   server.listen(port, 'localhost');

diff --git a/test/getPrf.test.js b/test/getPrf.test.js
index a8c4aa84695448a8cb2be40b683b07b2d8306b6b..ba1ed498ab1931e42332a0ec9df7ccfa1ce9821b 100644 (file)
--- a/test/getPrf.test.js
+++ b/test/getPrf.test.js
@@ -138,6 +138,12 @@ suite('getPrf.js (server)', () => {
     deepStrictEqual((await fetch(makePostRequest(url, { prf: Uint8Array.fromHex('11'.repeat(33)) }))).status, 400);
     deepStrictEqual((await fetch(makePostRequest(url, { prf: Uint8Array.fromHex('11'.repeat(32)) }))).status, 200);
   });
+  test('rejects all request methods that are not GET or POST', async (t) => {
+    const { url } = await setupServer(t);
+    for (const method of ['DELETE', 'HEAD', 'OPTIONS', 'PATCH', 'PUT']) {
+      deepStrictEqual((await fetch(url, { method })).status, 400);
+    }
+  });
   test('window expiration works', async (t) => {
     t.mock.timers.enable({ apis: ['setTimeout'] }); // MUST be called BEFORE setupServer()
     const { url } = await setupServer(t);