Sending 405 from express.js when there is a route match but no HTTP method match

Question

I'm looking for a clean way to have my express app return 405 Method Not Allowed if a client sends a request that matches a mapped url route but does not match the mapped HTTP method.

My current implementation is to have a default "catch-all" handler that tries to match the url against the register routes, ignoring the HTTP method. If there is a match, then we know to return a 405, otherwise we let express do its default 404 behavior.

I'm hoping there is a better way that doesn't involve running all the route matching twice (once by express, once by my handler).

Answer 1

Here is an approach that I have used successfully with multiple Django applications and now with Node and Express. It is also follows RFC 2616 (HTTP/1.1) that says the following about HTTP 405:

The response MUST include an Allow header containing a list of valid methods for the requested resource.

So, the key point is to route the requests to the same handler without regard to methods.

app.all('/page/:id', page.page);
app.all('/page/:id/comments', page.comments);
app.all('/page/:id/attachments', page.attachments);
...

The next point is to validate the method in the handler function 'comments'. Note that the handler is responsible for handling all the methods. In Django's world this is the only way to go because the framework forces you to separate the routing of the URLs from the actual action about to be performed against the resource the URL represents.

In the handler you could check the method like this...

exports.comments = function (req, res) {
    if (req.route.method === 'get') {
        res.send(200, 'Hello universe.');
    } else {
        res.set('Allow', 'GET');
        res.send(405, 'Method Not Allowed');
    }
}

...but as you can expect the code will quickly become repetitious and not nice to read especially when you have many handler functions and many different sets of allowed methods.

Therefore I prepared a shortcut function named restful for the job. Define the function wherever you want. I personally would place it in helpers.js under the same directory where the handler functions are implemented.

var restful = function (req, res, handlers) {
    // 
    // This shortcut function responses with HTTP 405
    // to the requests having a method that does not
    // have corresponding request handler. For example
    // if a resource allows only GET and POST requests
    // then PUT, DELETE, etc requests will be responsed
    // with the 405. HTTP 405 is required to have Allow
    // header set to a list of allowed methods so in
    // this case the response has "Allow: GET, POST" in
    // its headers [1].
    // 
    // Example usage
    //     
    //     A handler that allows only GET requests and returns
    //     
    //     exports.myrestfulhandler = function (req, res) {
    //         restful(req, res, {
    //             get: function (req, res) {
    //                 res.send(200, 'Hello restful world.');
    //             }
    //         });
    //     }
    // 
    // References
    //     
    //     [1] RFC-2616, 10.4.6 405 Method Not Allowed
    //     https://www.rfc-editor.org/rfc/rfc2616#page-66
    //     
    //     [2] Express.js request method
    //     http://expressjs.com/api.html#req.route
    //
    var method = req.route.method; // [2]
    if (!(method in handlers)) {
        res.set('Allow', Object.keys(handlers).join(', ').toUpperCase());
        res.send(405);
    } else {
        handlers[method](req, res);
    }
}

With restful it is now quite painless to handle 405 responses automatically and having proper Allow header being set. Just give a function for each method you allow and restful does the rest.

So lets modify the previous example:

exports.comments = function (req, res) {
    restful(req, res, {
        get: function (req, res) {
            res.send(200, 'Hello restful universe.');
        }
    });
}

Why the name restful? In RESTful web it is quite essential for the API to obey the conventions like responsing with HTTP 405 to the request having non-supported method. Many of those conventions could be integrated to restful when needed. Therefore the name is restful and not something like auto405 or http405handler.

Hope this helps. Any thoughts?

Answer 2

Method 1: Use .route() and .all()

// Your route handlers
const handlers = require(`./handlers.js`);

// The 405 handler
const methodNotAllowed = (req, res, next) => res.status(405).send();

router
.route(`/products`)
.get(handlers.getProduct)
.put(handlers.addProduct)
.all(methodNotAllowed);

This works because requests are passed to the handlers in the order they are attached to the route (the request "waterfall"). The .get() and .put() handlers will catch GET and PUT requests, and the rest will fall through to the .all() handler.

Method 2: Middleware

Create middleware which checks for allowed methods, and returns a 405 error if the method is not whitelisted. This approach is nice because it allows you to see and set the allowed methods for each route along with the route itself.

Here's the methods.js middleware:

const methods = (methods = ['GET']) => (req, res, next) => {
  if (methods.includes(req.method)) return next();
  res.error(405, `The ${req.method} method for the "${req.originalUrl}" route is not supported.`);
};

module.exports = methods;

You would then use the methods middleware in your routes like this:

const handlers = require(`./handlers.js`); // route handlers
const methods = require(`./methods.js`);   // methods middleware

// allows only GET or PUT requests
router.all(`/products`, methods([`GET`, `PUT`]), handlers.products);

// defaults to allowing GET requests only
router.all(`/products`, methods(), handlers.products);