diff --git a/RELEASE.md b/RELEASE.md new file mode 100644 index 0000000000..13075aa444 --- /dev/null +++ b/RELEASE.md @@ -0,0 +1,3 @@ +Release type: patch + +This release fixes an issue where a GET request is processed despite it being disallowed. diff --git a/strawberry/http/async_base_view.py b/strawberry/http/async_base_view.py index 7eef89aa40..abb83ced91 100644 --- a/strawberry/http/async_base_view.py +++ b/strawberry/http/async_base_view.py @@ -2,6 +2,7 @@ import asyncio import contextlib import json +from http import HTTPStatus from typing import ( Any, AsyncGenerator, @@ -184,6 +185,12 @@ async def run( else: raise HTTPException(404, "Not Found") + if request_adapter.method == "GET" and not self.allow_queries_via_get: + raise HTTPException( + HTTPStatus.METHOD_NOT_ALLOWED, + HTTPStatus.METHOD_NOT_ALLOWED.phrase, + ) + sub_response = await self.get_sub_response(request) context = ( await self.get_context(request, response=sub_response) diff --git a/strawberry/http/sync_base_view.py b/strawberry/http/sync_base_view.py index f1ce7ca19a..4307cf1057 100644 --- a/strawberry/http/sync_base_view.py +++ b/strawberry/http/sync_base_view.py @@ -1,5 +1,6 @@ import abc import json +from http import HTTPStatus from typing import ( Any, Callable, @@ -180,6 +181,12 @@ def run( else: raise HTTPException(404, "Not Found") + if request_adapter.method == "GET" and not self.allow_queries_via_get: + raise HTTPException( + HTTPStatus.METHOD_NOT_ALLOWED, + HTTPStatus.METHOD_NOT_ALLOWED.phrase, + ) + sub_response = self.get_sub_response(request) context = ( self.get_context(request, response=sub_response) diff --git a/tests/http/test_query_via_get.py b/tests/http/test_query_via_get.py index 5e7557a197..58b99af6ff 100644 --- a/tests/http/test_query_via_get.py +++ b/tests/http/test_query_via_get.py @@ -1,3 +1,5 @@ +from http import HTTPStatus + from .clients.base import HttpClient @@ -40,5 +42,5 @@ async def test_fails_if_allow_queries_via_get_false(http_client_class): response = await http_client.query(method="get", query="{ hello }") - assert response.status_code == 400 - assert "queries are not allowed when using GET" in response.text + assert response.status_code == HTTPStatus.METHOD_NOT_ALLOWED + assert HTTPStatus.METHOD_NOT_ALLOWED.phrase in response.text