yii2: yii\filters\VerbFilter violates HTTP 1.1 spec

I bet Microsoft was thinking along those lines too /…/

🤦 You’re really overreacting here. All proper requests with standard HTTP method are handling properly. And if you want to have put and PUT methods that works differently, you’re just asking for trouble - it is good that Yii does not allow you to do that.

Good catch, I wonder what their reaction would be if someone reports them the fact that they are violating HTTP spec too?

There is only one way to find out. 😈

This is just your assumption and not a fact.

I’ve reviewed about 10 apps this year and all of them used lowercase method names.

Such applications SHOULD be broken for exactly the same reason - the applications not following the standard ideally should not exist at all.

These will be suddenly broken after minor update and implications could be really serious including security issues.

Overall, I’m OK requiring uppercase methods in 2.1 but doubt it’s a good change for 2.0.

I am not saying that Yii should not follow the standard, but as it currently does not, changing it will break a lot of applications and therefore we need to weigth the practial application of non-uppercase HTTP methods vs. breaking existing applications. I currently do not see the need to break anything in 2.0.x. We can adjust it in 2.1 to be compatible.

Please share the link to the Symfony issue with your report, I’m curious how this will be handled. Also remember to report similar to the Laravel.

And in every app you reviewed your response to the authors should have been “What are you doing violating the spec? Fix this immediately!”.

That’s not the point. The point is that many apps will be broken for sure. Following the spec if fine but breaking many existing apps in minor version intentionally for the sake of formal compliance and nothing else is not.

That’s the way of life - BC breaks happen even when we do not anticipate them.

In this case we know exactly that apps will be broken. The right thing to do in this case is to use 2.1 tag to release it where intentional breaks are totally fine. Of course, we sometimes introducing intentional breaks in 2.0 but these are for things concerning security mostly which could not be avoided.

Can’t really think of any possible situation where such a change will lead to security issues.

Right. Not in this case.

I do agree with @PowerGamer1 on this one, while those 10 applications @samdark reviewed used lower case, how many do not? It’s a problem I see all the time with Yii2 applications, yii2 doesn’t follow standards ( PSR or otherwise ) so why should the users of the framework?