main · last commit
18 hours ago ·
8tmadfpi
spec-84f Mount specs' /static/ with GET/HEAD only instead of registering every method
Lined Up
bd update spec-84f --claim
bd close spec-84f
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-08-17T20:40:11Z |
| Updated | 2026-08-17T20:40:11Z |
What is wrong: specs mounts `/static/` with `r.Mount(assets.DefaultPrefix, s.static)`, which registers every HTTP method on that route tree. Why it matters: a same-origin POST to `/static/main.min.<sha>.css` is served the file with a 200 instead of a rendered 405 — harmless today, but it means the routing tree does not describe what the service actually serves, which is exactly the argument for using a GET/HEAD-only mount. Sibling that does it correctly: `chimw.GetHead(r, assets.DefaultPrefix+"*", …)` in `sourcehut-artifacts`, `sourcehut-bench`, `sourcehut-curator`, `sourcehut-tokens`. Fix: replace `r.Mount(assets.DefaultPrefix, s.static)` with `chimw.GetHead(r, assets.DefaultPrefix+"*", s.static)` (or equivalent) in specs' router setup. Audit: D38 (cross-repo audit, 2026-08-17)
No outgoing dependencies.
Nothing depends on this issue.
| id | spec-84f |
| content_hash | d5810e3d68cf6a45ec5f2d042790315b287408a1feebb8f317e27b0a9b6a6780 |
| title | Mount specs' /static/ with GET/HEAD only instead of registering every method |
| description | What is wrong: specs mounts `/static/` with `r.Mount(assets.DefaultPrefix, s.static)`, which registers every HTTP method on that route tree. Why it matters: a same-origin POST to `/static/main.min.<sha>.css` is served the file with a 200 instead of a rendered 405 — harmless today, but it means the routing tree does not describe what the service actually serves, which is exactly the argument for using a GET/HEAD-only mount. Sibling that does it correctly: `chimw.GetHead(r, assets.DefaultPrefix+"*", …)` in `sourcehut-artifacts`, `sourcehut-bench`, `sourcehut-curator`, `sourcehut-tokens`. Fix: replace `r.Mount(assets.DefaultPrefix, s.static)` with `chimw.GetHead(r, assets.DefaultPrefix+"*", s.static)` (or equivalent) in specs' router setup. Audit: D38 (cross-repo audit, 2026-08-17) |
| design | |
| acceptance_criteria | |
| notes | |
| status | open |
| priority | 3 |
| issue_type | task |
| assignee | NULL |
| estimated_minutes | NULL |
| created_at | 2026-08-17T20:40:11Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-08-17T20:40:11Z |
| closed_at | NULL |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | �{} |
| source_repo | |
| close_reason | |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | NULL |
| is_blocked | 0 |
| id | 01a01174-02c1-7e19-ba3b-9ebd356f64be |
| issue_id | spec-84f |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-08-17T23:40:10Z |
No comments.