3.4.8

The router has automatic handling of OPTIONS based on the registered
routes, but if you make an OPTIONS request for an endpoint that does
not exist, then it will still return a 200 with nothing allowed.
Instead, we can let the request move on down the middleware chain. This
has two benefits: first, if the route was not defined and no other
middleware handles it, it will return with a 404. Secondly, if multiple
routers are used and a later one has the route or a custom OPTIONS
defined, the first router will not respond incorrectly.

History.md

@@ -1,3 +1,25 @@
+4.0.0 /
+==================
+
+ * remove:
+   - express(1) - moved to [express-generator](https://github.com/expressjs/generator)
+   - `req.accepted*` - use `req.accepts*()` instead
+   - `app.configure` - use logic in your own app code
+ * change:
+   - `req.accepts*` -> `req.accepts*s` - i.e. `req.acceptsEncoding` -> `req.acceptsEncodings`
+   - `req.params` is now an object instead of an array
+   - `json spaces` no longer enabled by default in development
+ * refactor:
+   - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)
+   - `req.is` with [type-is](https://github.com/expressjs/type-is)
+
+3.4.8 / 2014-01-13
+==================
+
+ * prevent incorrect automatic OPTIONS responses #1868 @dpatti
+ * update binary and examples for jade 1.0 #1876 @yossi, #1877 @reqshark, #1892 @matheusazzi
+ * throw 400 in case of malformed paths @rlidwka
+
 3.4.7 / 2013-12-10
 ==================
 

examples/jade/views/layout.jade

@@ -1,5 +1,5 @@
-!!! 5
+doctype html
 html
   include header
   body
-    block content
+    block content

lib/router/index.js

@@ -104,7 +104,7 @@ Router.prototype._dispatch = function(req, res, next){
     req.route = route = self.matchRequest(req, i);
 
     // implied OPTIONS
-    if (!route && 'OPTIONS' == req.method) return self._options(req, res);
+    if (!route && 'OPTIONS' == req.method) return self._options(req, res, next);
 
     // no route
     if (!route) return next(err);
@@ -181,9 +181,10 @@ Router.prototype._dispatch = function(req, res, next){
  * @api private
  */
 
-Router.prototype._options = function(req, res){
+Router.prototype._options = function(req, res, next){
   var path = parse(req).pathname
     , body = this._optionsFor(path).join(',');
+  if (!body) return next();
   res.set('Allow', body).send(body);
 };
 

package.json

@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.4.7",
+  "version": "3.4.8",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

test/app.options.js

@@ -15,6 +15,30 @@ describe('OPTIONS', function(){
     .expect('GET,PUT')
     .expect('Allow', 'GET,PUT', done);
   })
+
+  it('should not respond if the path is not defined', function(done){
+    var app = express();
+
+    app.get('/users', function(req, res){});
+
+    request(app)
+    .options('/other')
+    .expect(404, done);
+  })
+
+  it('should forward requests down the middleware chain', function(done){
+    var app = express();
+    var router = new express.Router();
+
+    router.get('/users', function(req, res){});
+    app.use(router.middleware);
+    app.get('/other', function(req, res){});
+
+    request(app)
+    .options('/other')
+    .expect('GET')
+    .expect('Allow', 'GET', done);
+  })
 })
 
 describe('app.options()', function(){