Laravel 10 Disable OPTIONS Method

Asked Aug 09 '23 at 11:44

Active Aug 09 '23 at 11:44

Viewed 57 times

I have developed web application using Laravel 10 and nginx, I want to allow only post method for specific route

Route::post('/otpgen', 'App\Http\Controllers\controller@otpgen');

I have following code in my app\Exception\Handler.php

public function render($request, Throwable $e)
    {
        if ($e instanceof MethodNotAllowedHttpException) {
            return abort(404);
        }
        
        return parent::render($request, $e);
    }

as allowed method is POST, for all other request method like HEAD,GET,DELETE i am getting 405 method not allowed response code which is correct, but as you can see in image for OPTIONS method i am always getting 200 instead of 405, I want 405 for OPTIONS method too.

asked Aug 09 '23 at 11:44

user3782114

OPTIONS is for cors. Disable cors - and i think all will be fine. – Maksim Aug 09 '23 at 12:19
@Maksim, thanks for comment, any hint on how to disable CORS ? – user3782114 Aug 09 '23 at 12:31
Comment cors middleware in HttpKernel. But this is not good thing, after this your app cannot work with modern browsers. – Maksim Aug 09 '23 at 20:42
@Maksim, it is VAPT finding that unsecure HTTP method OPTIONS is allowed, they want me to disable it – user3782114 Aug 10 '23 at 07:29
I think, this is not good point of security analysis. – Maksim Aug 10 '23 at 15:52
@Maksim, yes ..by the way i have handled it at nginx level – user3782114 Aug 10 '23 at 16:38

Laravel 10 Disable OPTIONS Method

0 Answers0