[Howriq]

Added a query() method to RouteCollector and RouteGroupCollector for registering routes that match the HTTP QUERY method (RFC 10008).

Backward compatibility

Adding query() to RouteCollectorInterface and RouteGroupCollectorInterface is a breaking change for third-party classes that implement these interfaces. Code that only calls the collectors is not affected.

Known limitations (outside this package)

• any() routes don't match QUERY. mezzio-fastroute expands any() routes to its fixed HTTP_METHODS_STANDARD list, which doesn't include QUERY. Routes that should answer QUERY must be registered with query() or route(..., ['QUERY']).
• CORS: mezzio-cors 1.16.0 only accepts a fixed list of methods (CorsMetadata::ALLOWED_REQUEST_METHODS), so cross-origin QUERY requests and their preflights fail with a 500. This needs a fix in mezzio-cors.
• PHP built-in server: php -S (PHP 8.5.12) answers QUERY with 501 Not Implemented, so these routes can't be tested with composer serve. Apache handles QUERY correctly (tested); nginx reportedly does too.

[alexmerlin]

Feedback on the known limitations

any() routes don't match QUERY

I don't see many use cases for routes being open to all request methods, so this should not be an issue.

---

CORS: mezzio-cors 1.16.0 only accepts a fixed list of methods

Does this mean that if we try to configure allowedMethods, the QUERY endpoint will fail with 500?
So, we need to stay with the default (unconfigred) config, which allows all methods in CORS?

---

PHP built-in server: php -S (PHP 8.5.12) answers QUERY with 501 Not Implemented

As long as Apache/Nginx are able to handle these requests, I don't see an issue with this.

[arhimede]

@Howriq should we extend mezzio-cors maybe ?

[Howriq]

@arhimede

Does this mean that if we try to configure allowedMethods, the QUERY endpoint will fail with 500?
So, we need to stay with the default (unconfigred) config, which allows all methods in CORS?

we can't easily extend the library, because its classes are locked against overriding (final).

@alexmerlin

Does this mean that if we try to configure allowedMethods, the QUERY endpoint will fail with 500?
So, we need to stay with the default (unconfigred) config, which allows all methods in CORS?

allowed_methods isn't configurable in mezzio-cors. allowedMethods() is only a getter and there's no setAllowedMethods(). Browser QUERY requests get a 500 even with the default config and my implementation worked only because I didn't add the Origin header in my requests when I have tested with Bruno.

[Howriq]

@alexmerlin @arhimede

• Routes registered with any() don't respond to QUERY.
• mezzio-fastroute: any() routes don't match QUERY
• mezzio-cors 1.16.0: cross-origin QUERY requests and preflights return a 500. That blocks browser clients on another domain.
• fig/http-message-util: there's no METHOD_QUERY constant.

[arhimede]

• fig/http-message-util

I don;'t get the meaning of this comment
It is working or not ?

[Howriq]

@arhimede

I don;'t get the meaning of this comment
It is working or not ?

It works. That bullet was not a real issue, so I'm removing it.

fig/http-message-util has no METHOD_QUERY constant, but nothing in dot-router uses those constants. The existing helpers delegate to Mezzio, which uses plain strings (['GET'], ['POST'], ...), and query() does the same with ['QUERY'].

[arhimede]

related to php-fig/http-message-util#22