Skip to content

Commit 4a18864

Browse files
committed
Document method spoofing. Fixes #1668
1 parent 2e698a1 commit 4a18864

2 files changed

Lines changed: 26 additions & 1 deletion

File tree

user_guide_src/source/incoming/index.rst

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,5 @@ Controllers handle incoming requests.
1313
message
1414
request
1515
incomingrequest
16-
content_negotiation
16+
content_negotiation
17+
methodspoofing
Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
====================
2+
HTTP Method Spoofing
3+
====================
4+
5+
When working with HTML forms you can only use GET or POST HTTP verbs. In most cases this is just fine. However, to
6+
support REST-ful routing you need to support other, more correct, verbs, like DELETE or PUT. Since the browsers
7+
don't support this, CodeIgniter provides you with a way to spoof the method that is being used. This allows you to
8+
make a POST request, but tell the application that it should be treated as a different request type.
9+
10+
To spoof the method, a hidden input is added to the form with the name of ``_method``. It's value is the HTTP verb
11+
that you want the request to be::
12+
13+
<form action="" method="post">
14+
<input type="hidden" name="_method" value="PUT" />
15+
16+
</form>
17+
18+
This form is converted into a PUT request and is a true PUT request as far as the routing and the IncomingRequest
19+
class are concerned.
20+
21+
The form that you are using must be a POST request. GET requests cannot be spoofed.
22+
23+
.. note:: Be sure to check your web server's configuration as some servers do not support all HTTP verbs
24+
with the default configuration, and must have additional packages enabled to work.

0 commit comments

Comments
 (0)