Specify HTTP methods allowed for content requests from the CDN

By default, a CDN resource accepts all standard HTTP methods. The Enable HTTP methods option restricts which methods the CDN accepts, returning 405 Method Not Allowed for all others before the request reaches the origin.

Allowed HTTP methods

To configure allowed HTTP methods:

1. Log in to the CDB Technical Web Portal and navigate to CDN > CDN resources.

2. Click the CNAME of the resource to open its settings.

3. On the OPTIONS tab, scroll to HTTP methods and click the Enable HTTP methods toggle.

4. In the Choose HTTP methods field, add the methods the CDN should accept. Remove any method tag to block that method.

5. Click Save changes.

For most static content delivery, GET and HEAD are sufficient. Allow POST as well if the resource serves dynamic requests, form submissions, or API calls.

6. Confirm a method that is not in the list:

curl -I -X POST https://cdn.example.com/file.css

The CDN returns 405 Method Not Allowed and does not forward the request to the origin. A GET request is accepted, and its status is the origin response.

When allowedHttpMethods is enabled, the CDN accepts only the methods in value, so any other method returns HTTP 405.

When the field is absent, the CDN does not apply this limit.

ℹ️

An API token is required.

Export these variables. CDN_RESOURCE_ID is the id from list CDN resources.

export GCORE_API_KEY="{YOUR_API_KEY}"
export CDN_RESOURCE_ID="{YOUR_RESOURCE_ID}"

HTTP methods

value accepts GET, HEAD, POST, PUT, PATCH, DELETE, and OPTIONS. The names are case sensitive.

GET and HEAD cover static delivery. Add POST when the resource serves dynamic requests, form submissions, or API calls.

Both enabled and value are required. When enabled is true, an empty value returns HTTP 400.

The JSON field is allowedHttpMethods. The Python SDK attribute is allowed_http_methods.

Send allowedHttpMethods with enabled true and value set to GET and HEAD.

import os

from gcore import CDB

client = CDB()
resource_id = int(os.environ["CDN_RESOURCE_ID"])

resource = client.cdn.cdn_resources.update(
    resource_id,
    options={
        "allowed_http_methods": {"enabled": True, "value": ["GET", "HEAD"]},
    },
)
print(resource.options.allowed_http_methods.enabled, resource.options.allowed_http_methods.value)

package main

import (
    "context"
    "fmt"
    "os"
    "strconv"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/cdn"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()
    resourceID, err := strconv.ParseInt(os.Getenv("CDN_RESOURCE_ID"), 10, 64)
    if err != nil {
        panic(err)
    }

    resource, err := client.CDN.CDNResources.Update(ctx, resourceID, cdn.CDNResourceUpdateParams{
        Options: cdn.CDNResourceUpdateParamsOptions{
            AllowedHTTPMethods: cdn.CDNResourceUpdateParamsOptionsAllowedHTTPMethods{
                Enabled: true,
                Value:   []string{"GET", "HEAD"},
            },
        },
    })
    if err != nil {
        panic(err)
    }
    fmt.Println(resource.Options.AllowedHTTPMethods.Enabled, resource.Options.AllowedHTTPMethods.Value)
}

curl -X PATCH "https://api.cdb-staging.cdn.orange.com/cdn/resources/$CDN_RESOURCE_ID" \
  -H "Authorization: APIKey $GCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "options": {
      "allowedHttpMethods": {
        "enabled": true,
        "value": ["GET", "HEAD"]
      }
    }
  }'

The API returns HTTP 200:

{
  "id": 12345,
  "options": {
    "allowedHttpMethods": {
      "enabled": true,
      "value": ["GET", "HEAD"]
    }
  }
}

Restrict the HTTP methods a CDN resource accepts with the Terraform provider v2. When allowed_http_methods is enabled, the CDN accepts only the methods in value, so any other method returns 405 Method Not Allowed before the request reaches the origin.

value accepts GET, HEAD, POST, PUT, PATCH, DELETE, and OPTIONS. The names are case sensitive. GET and HEAD cover static delivery. Add POST when the resource serves dynamic requests, form submissions, or API calls. An empty value while enabled is true returns HTTP 400 and the message This list should not be empty while option is enabled. Run terraform apply after editing options.

Allow GET and HEAD

Set enabled to true and value to GET and HEAD. A client that sends another method receives 405 Method Not Allowed.

resource "gcore_cdn_origin_group" "example" {
  name = "my-origin-group"

  sources = [
    {
      source  = "example.com"
      enabled = true
    }
  ]
}

resource "gcore_cdn_resource" "example" {
  cname           = "cdn.example.com"
  origin_group    = gcore_cdn_origin_group.example.id
  origin_protocol = "HTTPS"

  options = {
    allowed_http_methods = {
      enabled = true
      value   = ["GET", "HEAD"]
    }
  }
}