Description Krishna 2011-12-06 09:43:53 EST

Build Identifier: 7.4.5.v20110725

Even with the following definition in web.xml the CrossOriginFilter returns a 405 for PUT requests.

       <filter>
               <filter-name>cross-origin</filter-name>
               <filter-class>org.eclipse.jetty.servlets.CrossOriginFilter
               </filter-class>
               <init-param>
                       <param-name>allowedMethods</param-name>
                       <param-value>GET,POST,PUT,OPTIONS,HEAD</param-value>
               </init-param>
       </filter>

The pre-flight response is:

Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS, HEAD

This seems be due to the way the method isMethodAllowed in the filter is structured. The method checks to see if the header Access-Control-Request-Method is present. However, for the actual PUT request browsers (at least Firefox in my limited testing) do not send this header; it is sent only for the pre-flight OPTIONS request.

This page also seems to suggest that the browsers will not send this header for the actual PUT request:
http://www.html5rocks.com/en/tutorials/cors/#toc-handling-a-not-so-simple-request

This bug was confirmed in the mailing list: http://dev.eclipse.org/mhonarc/lists/jetty-users/msg01755.html

Reproducible: Always

Steps to Reproduce:
1. Set up the CrossOriginFilter with PUT being added to the allowedMethods init-param
2. Hit an end-point that supports PUT