From: Ardis Lu <ardisglu@gmail.com>
Date: Thu, 16 Jul 2026 05:41:33 +0000 (-0700)
Subject: Explicitly reject methods that are not GET or POST
X-Git-Tag: v0.1.4~11
X-Git-Url: https://git.ardis.lu/?a=commitdiff_plain;h=19bd9ff3c9dfa01a3717121a39363354bba68269;p=envpass

Explicitly reject methods that are not GET or POST
---

diff --git a/src/getPrf.js b/src/getPrf.js
index 264fe3c..c46e413 100644
--- a/src/getPrf.js
+++ b/src/getPrf.js
@@ -164,6 +164,11 @@ export async function getPrf(options = {}) {
         return;
       });
     }
+    // Explicitly reject all other methods
+    else {
+      response.writeHead(400).end();
+      return;
+    }
   });
 
   server.listen(port, 'localhost');
diff --git a/test/getPrf.test.js b/test/getPrf.test.js
index a8c4aa8..ba1ed49 100644
--- a/test/getPrf.test.js
+++ b/test/getPrf.test.js
@@ -138,6 +138,12 @@ suite('getPrf.js (server)', () => {
     deepStrictEqual((await fetch(makePostRequest(url, { prf: Uint8Array.fromHex('11'.repeat(33)) }))).status, 400);
     deepStrictEqual((await fetch(makePostRequest(url, { prf: Uint8Array.fromHex('11'.repeat(32)) }))).status, 200);
   });
+  test('rejects all request methods that are not GET or POST', async (t) => {
+    const { url } = await setupServer(t);
+    for (const method of ['DELETE', 'HEAD', 'OPTIONS', 'PATCH', 'PUT']) {
+      deepStrictEqual((await fetch(url, { method })).status, 400);
+    }
+  });
   test('window expiration works', async (t) => {
     t.mock.timers.enable({ apis: ['setTimeout'] }); // MUST be called BEFORE setupServer()
     const { url } = await setupServer(t);