allows head requests to return 200 instead of 403

[joshmkennedy]

Changes

• What does this change?

fixes this issue #13079 by checking if the request method is "HEAD" it allows it to continue with the middleware and not return a 403

I don't believe the docs should need to be updated

[changeset-bot]

🦋 Changeset detected

Latest commit: 6e926f5

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[ematipico]

Please create a test and a changeset

[codspeed-hq]

CodSpeed Performance Report

Merging #13100 will not alter performance

_{Comparing joshmkennedy:fix-head-method-403 (6e926f5) with main (23e631c)}

Summary

✅ 6 untouched benchmarks

[corneliusroemer]

Suggested change

	if (request.method === 'GET' || request.method === "HEAD") {
	if (request.method === 'GET' || request.method === 'HEAD' || request.method === 'OPTIONS' || request.method === 'TRACE') {

There are 2 more safe request methods that should be added as exemptions besides GET and HEAD: OPTIONS and TRACE.

Maybe one should add centralized functions to define safe and unsafe functions/properties on request? So one can do:

if (request.isSafe) { ... }

and reduce scope for making the same mistake in multiple places?

See source for definition of safe methods: https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods#safe_idempotent_and_cacheable_request_methods

[joshmkennedy]

👍

[github-actions]

This PR is blocked because it contains a major changeset. A reviewer will merge this at the next release if approved.

[joshmkennedy]

I believe may @corneliusroemer may have a better solution here #13101