From d01588cb654553ba4a4b48ab80a9a652deea11fc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mindaugas=20Vaitiek=C5=ABnas?= Date: Sat, 29 Nov 2025 13:22:43 +0100 Subject: [PATCH] [HttpFoundation] update supported HTTP methods list for X-HTTP-METHOD-OVERRIDE --- reference/configuration/framework.rst | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/reference/configuration/framework.rst b/reference/configuration/framework.rst index 28e9989196d..3a1fc429350 100644 --- a/reference/configuration/framework.rst +++ b/reference/configuration/framework.rst @@ -1786,9 +1786,10 @@ This option controls which HTTP methods can be overridden via the ``_method`` request parameter or the ``X-HTTP-METHOD-OVERRIDE`` header when :ref:`http_method_override ` is enabled. -When set to ``null`` (the default), all HTTP methods can be overridden. When set -to an empty array (``[]``), HTTP method overriding is completely disabled. When -set to a specific list of methods, only those methods will be allowed as overrides: +When set to ``null`` (the default), all HTTP methods except for ``GET``, ``HEAD``, +``TRACE``, and ``CONNECT`` can be overridden. When set to an empty array (``[]``), +HTTP method overriding is completely disabled. When set to a specific list of methods, +only those methods will be allowed as overrides: .. configuration-block::