POST requests being blocked by default in Apache

[sindinero]

Hello team, we're having an issue with a Laravel application in our Server (Centos 7 + Apache + DirectAdmin).

The problem is:

All external POST requests return an HTTP Error 405:

Symfony\Component\HttpKernel\Exception\MethodNotAllowedHttpException
The GET method is not supported for this route. Supported methods: POST.

What we understand from the message above, is that somehow, the POST requests arriving on the server are being changed automatically to GET requests for some reason that we don't understand.

The following is a summary of the actions we already took to troubleshooting the issue:

Action 1: Check the .htaccess file to look for rewrite rules affecting POST requests.

There was nothing related to this inside the htaccess. For security reasons I'm not going to openly share the contents of the .htacess here publicly, however, if somebody with suggestions want to check it out, I could send it privately.

Action 2: Check the Apache config files to look for rewrite rules affecting POST requests.

I found the file /etc/httpd/conf/extra/httpd-default.conf with the following rules:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
</IfModule>

I proceeded to comment all those lines inside the mentioned file, restarted the web server, and tried again.

However, the results were the same ERROR 405 with the message:

Symfony\Component\HttpKernel\Exception\MethodNotAllowedHttpException
The GET method is not supported for this route. Supported methods: POST.

Basically, nothing changed...

At this point, I'm out of ideas, not sure where to keep looking, not sure if it could be something of Laravel itself or some obscure Apache settings that are creating the issue.

IMPORTANT NOTE: for troubleshooting purposes, I embedded the same request inside a file that I accessed from my web browser, and the request passed successfully because the POST request came from inside the server (through my web file). So, that way, I confirmed the problem only occurs when the POST requests comes from the exterior (Postman for example).

Any help will be appreciated.

Cheers.
Alberto.

 

[factor]

what does

cat /usr/local/directadmin/custombuild/options.conf |grep http_methods

give?

 

[sindinero]

what does

cat /usr/local/directadmin/custombuild/options.conf |grep http_methods

give?

Hi Brent,

The result it's "http_methods=ALL"

Do you need to somethig else?

Cheers
Alberto

 

[Erulezz]

I’ve had an issue like this once.. turns out that the http -> https redirect was not functioning properly. While redirecting, it was losing track of the request-method (and the GET arguments).

Might be worth to take a look if you are using https and sending post requests to http with Postman.

 

[sindinero]

I’ve had an issue like this once.. turns out that the http -> https redirect was not functioning properly. While redirecting, it was losing track of the request-method (and the GET arguments).

Might be worth to take a look if you are using https and sending post requests to http with Postman.

Hi Erulezz,

Thanks for your contribution, as you mention I will do a review about the redirect https and sending post requests to http.

Cheers
Alberto

 

[Erulezz]

This by the way:

Symfony\Component\HttpKernel\Exception\MethodNotAllowedHttpException
The GET method is not supported for this route. Supported methods: POST.

suggests that APP_DEBUG is set to true. Did you change that to test this? In production mode that needs to be turned off or else your sensitive credentials can be leaked. Also check APP_ENV setting.