Documentation
¶
Overview ¶
Package methodoverride provides HTTP method override middleware for celeris.
HTML forms can only submit GET and POST requests. This middleware lets clients tunnel PUT, PATCH, DELETE, and other methods through a POST request by specifying the intended method via a form field or header.
Register with celeris.Server.Pre (not Server.Use) so the method is rewritten before routing occurs. New accepts an optional Config to customise behaviour:
- Config.AllowedMethods — original methods eligible for override (default: POST).
- Config.TargetMethods — valid override targets (default: PUT, DELETE, PATCH); values outside this set are silently ignored.
- Config.Getter — function that extracts the override value; built-in helpers are HeaderGetter, FormFieldGetter, FormThenHeaderGetter, and QueryGetter (note: QueryGetter carries CSRF risk via embeddable URLs).
- Config.Skip / Config.SkipPaths — skip the middleware per-request or by exact path.
The default getter checks form field DefaultFormField ("_method") first, then header DefaultHeader ("X-HTTP-Method-Override"). Config.AllowedMethods and Config.TargetMethods must not contain empty or whitespace-only strings; the middleware panics at initialisation if this constraint is violated.
Documentation ¶
Full guides and examples: https://goceleris.dev/docs/middleware-routing-helpers
Index ¶
- Constants
- func FormFieldGetter(field string) func(*celeris.Context) string
- func FormThenHeaderGetter(field, header string) func(*celeris.Context) string
- func HeaderGetter(header string) func(*celeris.Context) string
- func New(config ...Config) celeris.HandlerFunc
- func QueryGetter(param string) func(*celeris.Context) string
- type Config
Examples ¶
Constants ¶
const ( // DefaultHeader is the default HTTP header checked for method override. DefaultHeader = "X-HTTP-Method-Override" // DefaultFormField is the default form field checked for method override. DefaultFormField = "_method" )
Variables ¶
This section is empty.
Functions ¶
func FormFieldGetter ¶
FormFieldGetter returns a getter that reads the override method from the given form field.
func FormThenHeaderGetter ¶
FormThenHeaderGetter checks the form field first, then the header. This matches the default getter order with custom field/header names.
func HeaderGetter ¶
HeaderGetter returns a getter that reads the override method from the given HTTP header. The header name is lowercased for lookup.
func New ¶
func New(config ...Config) celeris.HandlerFunc
New creates a method override middleware with the given config. The middleware reads an overridden HTTP method from a configurable source (header, form field, or custom getter) and rewrites the request method before routing. Only POST requests are rewritten by default.
Example ¶
package main
import (
"github.com/goceleris/celeris/middleware/methodoverride"
)
func main() {
// Register via server.Pre() for pre-routing method override.
// s := celeris.New()
// s.Pre(methodoverride.New())
_ = methodoverride.New()
}
Output:
Example (CustomTargets) ¶
package main
import (
"github.com/goceleris/celeris/middleware/methodoverride"
)
func main() {
_ = methodoverride.New(methodoverride.Config{
TargetMethods: []string{"PUT", "DELETE", "PATCH", "GET"},
})
}
Output:
Example (FormFieldOnly) ¶
package main
import (
"github.com/goceleris/celeris/middleware/methodoverride"
)
func main() {
// Override from a custom form field only.
_ = methodoverride.New(methodoverride.Config{
Getter: methodoverride.FormFieldGetter("_http_method"),
})
}
Output:
Example (FormThenHeader) ¶
package main
import (
"github.com/goceleris/celeris/middleware/methodoverride"
)
func main() {
// Check form field first, then header (custom names).
_ = methodoverride.New(methodoverride.Config{
Getter: methodoverride.FormThenHeaderGetter("_method", "X-HTTP-Method"),
})
}
Output:
Example (HeaderOnly) ¶
package main
import (
"github.com/goceleris/celeris/middleware/methodoverride"
)
func main() {
// Override from a custom header only.
_ = methodoverride.New(methodoverride.Config{
Getter: methodoverride.HeaderGetter("X-Method"),
})
}
Output:
Example (QueryGetter) ¶
package main
import (
"github.com/goceleris/celeris/middleware/methodoverride"
)
func main() {
// Read override from ?_method query parameter.
// Security: query params are embeddable in links; use with caution.
_ = methodoverride.New(methodoverride.Config{
Getter: methodoverride.QueryGetter("_method"),
})
}
Output:
func QueryGetter ¶
QueryGetter returns a getter that reads the override method from the given query parameter. Use with caution: query-based overrides are vulnerable to cross-site attacks via embeddable URLs (e.g., <img src="...?_method=DELETE">). Prefer HeaderGetter for API clients.
Types ¶
type Config ¶
type Config struct {
// Skip defines a function to skip this middleware for certain requests.
Skip func(c *celeris.Context) bool
// SkipPaths lists paths to skip (exact match on c.Path()).
SkipPaths []string
// AllowedMethods lists the original HTTP methods eligible for override.
// Default: ["POST"]. Must not contain empty or whitespace-only strings.
AllowedMethods []string
// TargetMethods lists the HTTP methods that can be used as override targets.
// Override values not in this list are silently ignored.
// Default: ["PUT", "DELETE", "PATCH"].
TargetMethods []string
// Getter extracts the override method from the request. The returned
// string should be an HTTP method name (e.g. "PUT", "DELETE"). An
// empty return value means no override.
// Default: [defaultGetter] (checks form field [DefaultFormField] first,
// then header [DefaultHeader]).
Getter func(c *celeris.Context) string
}
Config defines the method override middleware configuration.
Source Files