From 19bd9ff3c9dfa01a3717121a39363354bba68269 Mon Sep 17 00:00:00 2001
From: Ardis Lu <ardisglu@gmail.com>
Date: Wed, 15 Jul 2026 22:41:33 -0700
Subject: [PATCH] Explicitly reject methods that are not GET or POST

---
 src/getPrf.js       | 5 +++++
 test/getPrf.test.js | 6 ++++++
 2 files changed, 11 insertions(+)

diff --git a/src/getPrf.js b/src/getPrf.js
index 264fe3c..c46e413 100644
--- a/src/getPrf.js
+++ b/src/getPrf.js
@@ -164,6 +164,11 @@ export async function getPrf(options = {}) {
         return;
       });
     }
+    // Explicitly reject all other methods
+    else {
+      response.writeHead(400).end();
+      return;
+    }
   });
 
   server.listen(port, 'localhost');
diff --git a/test/getPrf.test.js b/test/getPrf.test.js
index a8c4aa8..ba1ed49 100644
--- a/test/getPrf.test.js
+++ b/test/getPrf.test.js
@@ -138,6 +138,12 @@ suite('getPrf.js (server)', () => {
     deepStrictEqual((await fetch(makePostRequest(url, { prf: Uint8Array.fromHex('11'.repeat(33)) }))).status, 400);
     deepStrictEqual((await fetch(makePostRequest(url, { prf: Uint8Array.fromHex('11'.repeat(32)) }))).status, 200);
   });
+  test('rejects all request methods that are not GET or POST', async (t) => {
+    const { url } = await setupServer(t);
+    for (const method of ['DELETE', 'HEAD', 'OPTIONS', 'PATCH', 'PUT']) {
+      deepStrictEqual((await fetch(url, { method })).status, 400);
+    }
+  });
   test('window expiration works', async (t) => {
     t.mock.timers.enable({ apis: ['setTimeout'] }); // MUST be called BEFORE setupServer()
     const { url } = await setupServer(t);
-- 
2.47.3