From e82db2ca3a22c9614c1987392c9cfaa8c6ce99ad Mon Sep 17 00:00:00 2001 From: David Lord Date: Thu, 12 Feb 2026 13:03:03 -0800 Subject: [PATCH] fix provide_automatic_options override --- CHANGES.rst | 2 ++ docs/config.rst | 2 +- src/flask/sansio/app.py | 16 ++++----- tests/test_basic.py | 77 ++++++++++++++++++++-------------------- tests/test_blueprints.py | 23 ++++-------- tests/test_cli.py | 10 ++++-- tests/test_views.py | 54 +++++++++++++++++----------- 7 files changed, 97 insertions(+), 87 deletions(-) diff --git a/CHANGES.rst b/CHANGES.rst index fc3ef437..bd85117e 100644 --- a/CHANGES.rst +++ b/CHANGES.rst @@ -23,6 +23,8 @@ Unreleased switching ``POST`` to ``GET``. This preserves the current behavior of ``GET`` and ``POST`` redirects, and is also correct for frontend libraries such as HTMX. :issue:`5895` +- ``provide_automatic_options=True`` can be used to enable it for a view when + it's disabled in config. Previously, only disabling worked. :issue:`5916` Version 3.1.2 diff --git a/docs/config.rst b/docs/config.rst index e7d4410a..416c3391 100644 --- a/docs/config.rst +++ b/docs/config.rst @@ -445,7 +445,7 @@ The following configuration values are used internally by Flask: .. versionchanged:: 2.3 ``ENV`` was removed. -.. versionadded:: 3.10 +.. versionadded:: 3.1 Added :data:`PROVIDE_AUTOMATIC_OPTIONS` to control the default addition of autogenerated OPTIONS responses. diff --git a/src/flask/sansio/app.py b/src/flask/sansio/app.py index e069b908..a734793e 100644 --- a/src/flask/sansio/app.py +++ b/src/flask/sansio/app.py @@ -627,19 +627,19 @@ class App(Scaffold): # Methods that should always be added required_methods: set[str] = set(getattr(view_func, "required_methods", ())) - # starting with Flask 0.8 the view_func object can disable and - # force-enable the automatic options handling. if provide_automatic_options is None: provide_automatic_options = getattr( view_func, "provide_automatic_options", None ) - if provide_automatic_options is None: - if "OPTIONS" not in methods and self.config["PROVIDE_AUTOMATIC_OPTIONS"]: - provide_automatic_options = True - required_methods.add("OPTIONS") - else: - provide_automatic_options = False + if provide_automatic_options is None: + provide_automatic_options = ( + "OPTIONS" not in methods + and self.config["PROVIDE_AUTOMATIC_OPTIONS"] + ) + + if provide_automatic_options: + required_methods.add("OPTIONS") # Add the required methods now. methods |= required_methods diff --git a/tests/test_basic.py b/tests/test_basic.py index f8a11529..48365a6b 100644 --- a/tests/test_basic.py +++ b/tests/test_basic.py @@ -20,6 +20,7 @@ from werkzeug.routing import BuildError from werkzeug.routing import RequestRedirect import flask +from flask.testing import FlaskClient require_cpython_gc = pytest.mark.skipif( python_implementation() != "CPython", @@ -67,63 +68,61 @@ def test_method_route_no_methods(app): app.get("/", methods=["GET", "POST"]) -def test_provide_automatic_options_attr(): - app = flask.Flask(__name__) +def test_provide_automatic_options_attr_disable( + app: flask.Flask, client: FlaskClient +) -> None: + """Automatic options can be disabled by the view func attribute.""" def index(): return "Hello World!" index.provide_automatic_options = False - app.route("/")(index) - rv = app.test_client().open("/", method="OPTIONS") + app.add_url_rule("/", view_func=index) + rv = client.options() assert rv.status_code == 405 - app = flask.Flask(__name__) - def index2(): +def test_provide_automatic_options_attr_enable( + app: flask.Flask, client: FlaskClient +) -> None: + """When default automatic options is disabled in config, it can still be + enabled by the view function attribute. + """ + app.config["PROVIDE_AUTOMATIC_OPTIONS"] = False + + def index(): return "Hello World!" - index2.provide_automatic_options = True - app.route("/", methods=["OPTIONS"])(index2) - rv = app.test_client().open("/", method="OPTIONS") - assert sorted(rv.allow) == ["OPTIONS"] + index.provide_automatic_options = True + app.add_url_rule("/", view_func=index) + rv = client.options() + assert rv.allow == {"GET", "HEAD", "OPTIONS"} -def test_provide_automatic_options_kwarg(app, client): +def test_provide_automatic_options_arg_disable( + app: flask.Flask, client: FlaskClient +) -> None: + """Automatic options can be disabled by the route argument.""" + + @app.get("/", provide_automatic_options=False) def index(): - return flask.request.method + return "Hello World!" - def more(): - return flask.request.method - - app.add_url_rule("/", view_func=index, provide_automatic_options=False) - app.add_url_rule( - "/more", - view_func=more, - methods=["GET", "POST"], - provide_automatic_options=False, - ) - assert client.get("/").data == b"GET" - - rv = client.post("/") - assert rv.status_code == 405 - assert sorted(rv.allow) == ["GET", "HEAD"] - - rv = client.open("/", method="OPTIONS") + rv = client.options() assert rv.status_code == 405 - rv = client.head("/") - assert rv.status_code == 200 - assert not rv.data # head truncates - assert client.post("/more").data == b"POST" - assert client.get("/more").data == b"GET" - rv = client.delete("/more") - assert rv.status_code == 405 - assert sorted(rv.allow) == ["GET", "HEAD", "POST"] +def test_provide_automatic_options_method_disable( + app: flask.Flask, client: FlaskClient +) -> None: + """Automatic options is ignored if the route handles options.""" - rv = client.open("/more", method="OPTIONS") - assert rv.status_code == 405 + @app.route("/", methods=["OPTIONS"]) + def index(): + return "", {"X-Test": "test"} + + rv = client.options() + assert rv.headers["X-Test"] == "test" def test_request_dispatching(app, client): diff --git a/tests/test_blueprints.py b/tests/test_blueprints.py index ed1683c4..001e1981 100644 --- a/tests/test_blueprints.py +++ b/tests/test_blueprints.py @@ -220,28 +220,19 @@ def test_templates_and_static(test_apps): assert flask.render_template("nested/nested.txt") == "I'm nested" -def test_default_static_max_age(app): +def test_default_static_max_age(app: flask.Flask) -> None: class MyBlueprint(flask.Blueprint): def get_send_file_max_age(self, filename): return 100 - blueprint = MyBlueprint("blueprint", __name__, static_folder="static") + blueprint = MyBlueprint( + "blueprint", __name__, url_prefix="/bp", static_folder="static" + ) app.register_blueprint(blueprint) - # try/finally, in case other tests use this app for Blueprint tests. - max_age_default = app.config["SEND_FILE_MAX_AGE_DEFAULT"] - try: - with app.test_request_context(): - unexpected_max_age = 3600 - if app.config["SEND_FILE_MAX_AGE_DEFAULT"] == unexpected_max_age: - unexpected_max_age = 7200 - app.config["SEND_FILE_MAX_AGE_DEFAULT"] = unexpected_max_age - rv = blueprint.send_static_file("index.html") - cc = parse_cache_control_header(rv.headers["Cache-Control"]) - assert cc.max_age == 100 - rv.close() - finally: - app.config["SEND_FILE_MAX_AGE_DEFAULT"] = max_age_default + with app.test_request_context(), blueprint.send_static_file("index.html") as rv: + cc = parse_cache_control_header(rv.headers["Cache-Control"]) + assert cc.max_age == 100 def test_templates_list(test_apps): diff --git a/tests/test_cli.py b/tests/test_cli.py index a5aab501..8f8f25cf 100644 --- a/tests/test_cli.py +++ b/tests/test_cli.py @@ -483,12 +483,18 @@ class TestRoutes: ["yyy_get_post", "static", "aaa_post"], invoke(["routes", "-s", "rule"]).output, ) - match_order = [r.endpoint for r in app.url_map.iter_rules()] + match_order = [ + r.endpoint + for r in app.url_map.iter_rules() + if r.endpoint != "_automatic_options" + ] self.expect_order(match_order, invoke(["routes", "-s", "match"]).output) def test_all_methods(self, invoke): output = invoke(["routes"]).output - assert "GET, HEAD, OPTIONS, POST" not in output + assert "HEAD" not in output + assert "OPTIONS" not in output + output = invoke(["routes", "--all-methods"]).output assert "GET, HEAD, OPTIONS, POST" in output diff --git a/tests/test_views.py b/tests/test_views.py index eab5eda2..d002b504 100644 --- a/tests/test_views.py +++ b/tests/test_views.py @@ -2,6 +2,7 @@ import pytest from werkzeug.http import parse_set_header import flask.views +from flask.testing import FlaskClient def common_test(app): @@ -98,44 +99,55 @@ def test_view_decorators(app, client): assert rv.data == b"Awesome" -def test_view_provide_automatic_options_attr(): - app = flask.Flask(__name__) +def test_view_provide_automatic_options_attr_disable( + app: flask.Flask, client: FlaskClient +) -> None: + """Automatic options can be disabled by the view class attribute.""" - class Index1(flask.views.View): + class Index(flask.views.View): provide_automatic_options = False def dispatch_request(self): return "Hello World!" - app.add_url_rule("/", view_func=Index1.as_view("index")) - c = app.test_client() - rv = c.open("/", method="OPTIONS") + app.add_url_rule("/", view_func=Index.as_view("index")) + rv = client.options() assert rv.status_code == 405 - app = flask.Flask(__name__) - class Index2(flask.views.View): - methods = ["OPTIONS"] +def test_view_provide_automatic_options_attr_enable( + app: flask.Flask, client: FlaskClient +) -> None: + """When default automatic options is disabled in config, it can still be + enabled by the view class attribute. + """ + app.config["PROVIDE_AUTOMATIC_OPTIONS"] = False + + class Index(flask.views.View): provide_automatic_options = True def dispatch_request(self): return "Hello World!" - app.add_url_rule("/", view_func=Index2.as_view("index")) - c = app.test_client() - rv = c.open("/", method="OPTIONS") - assert sorted(rv.allow) == ["OPTIONS"] + app.add_url_rule("/", view_func=Index.as_view("index")) + rv = client.options("/") + assert rv.allow == {"GET", "HEAD", "OPTIONS"} - app = flask.Flask(__name__) - class Index3(flask.views.View): +def test_provide_automatic_options_method_disable( + app: flask.Flask, client: FlaskClient +) -> None: + """Automatic options is ignored if the route handles options.""" + + class Index(flask.views.View): + methods = ["OPTIONS"] + def dispatch_request(self): - return "Hello World!" + return "", {"X-Test": "test"} - app.add_url_rule("/", view_func=Index3.as_view("index")) - c = app.test_client() - rv = c.open("/", method="OPTIONS") - assert "OPTIONS" in rv.allow + app.add_url_rule("/", view_func=Index.as_view("index")) + rv = client.options() + assert rv.headers["X-Test"] == "test" def test_implicit_head(app, client): @@ -180,7 +192,7 @@ def test_endpoint_override(app): app.add_url_rule("/", view_func=Index.as_view("index")) with pytest.raises(AssertionError): - app.add_url_rule("/", view_func=Index.as_view("index")) + app.add_url_rule("/other", view_func=Index.as_view("index")) # But these tests should still pass. We just log a warning. common_test(app)