When using Rails’ verify method to protect your ActionController actions, you should return a list of the allowed HTTP methods in the response headers.

Let’s say you have an action called update that you want to protect from anything but a POST. I like to do it like this:

Now if someone tries to hit the update action with anything other than a POST, an error message will be displayed and the response headers will contain (among other things):

In my opinion, this is a better way to go than redirecting to another action because the use of an improper HTTP method is most likely the result of either programmer error or malicious intent. By redirecting to another page, you are making it much easier to for somebody to take your site down with a denial of service attack and if it’s a programming error, you’ll locate the problem faster.

You should also make sure that you have a functional test for this behavior:

def test_invalid_update_methods
  [:get, :put, :delete].each do |http_method|
    send http_method, :update
    assert_response 405
    assert_equal 'POST', @response.headers['Allow']
    assert_equal '405 HTTP POST required', @response.body
  end
end

Additional Resources

• HTTP 1.1: Status Code Definitions
• HTTP 1.1: Header Field Definitions
• Rails API Documentation: Verification

RailsConf will be held right here in Portland this year, so no travelling for me this time around. The conference is being held at the Oregon Convention Center (the same place OSCON is held every year), so it’s a huge improvement over the shitty hotel in Chicago where it was held last year.

Registration just opened a couple of hours ago. This year the registration fee is higher and the venue is a lot larger so it probably won’t sell out as quickly as last year. But, if you want to go, I would sign up soon. I already did.

Updates:

• 7 hours later: I’m glad I bought mine early, because they might sell out faster than last year.
• 3 days later: RailsConf ‘07 sells faster than any other O’Reilly conference
• 9 days later: close to 75% of the tickets have now been sold.
• 22 days later: Sold out