Merge pull request #29 from clay/no-302s-on-head-requests

Extends isProtectedRoute to allow HEAD requests
clay · Aug 27, 2020 · 94201d6 · 94201d6
2 parents 5f72d8a + c178881
commit 94201d6
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/index.js b/index.js
@@ -20,12 +20,16 @@ const _isEmpty = require('lodash/isEmpty'),
 
 /**
  * determine if a route is protected
- * protected routes are ?edit=true and any method other than GET
+ * protected routes are ?edit=true and any method other than GET or HEAD
  * @param {object} req
  * @returns {boolean}
  */
 function isProtectedRoute(req) {
-  return !!req.query.edit || !_includes(req.originalUrl, '/_auth') && req.method !== 'GET';
+  return (
+    !!req.query.edit
+    || !_includes(req.originalUrl, '/_auth')
+    && !_includes(['GET', 'HEAD'], req.method)
+  );
 }
 
 /**

diff --git a/index.test.js b/index.test.js
@@ -30,6 +30,10 @@ describe(_startCase(filename), function () {
     it('is false if GET to api (or non-edit page)', function () {
       expect(fn({ query: {}, method: 'GET' })).toEqual(false);
     });
+
+    it('is false if HEAD to api (or non-edit page)', function () {
+      expect(fn({ query: {}, method: 'HEAD' })).toEqual(false);
+    });
   });
 
   describe('isAuthenticated', function () {