FOUR-33655: Reject OPTIONS requests to login

[eiresendez]

Issue & Reproduction Steps

Laravel automatically responds to OPTIONS /login with HTTP 200 and an Allow header. This behavior was reported as an HTTP OPTIONS exposure on the login endpoint.

Solution

• Add an explicit OPTIONS /login route that returns HTTP 405 with an empty response body.
• Preserve GET, HEAD, and POST as the allowed login methods.
• Add regression coverage for the expected response status, header, and body.

How to Test

• Run Tests\Feature\RouteTest::testLoginDoesNotAllowOptions.
• Verify that OPTIONS /login returns HTTP 405 with Allow: GET, HEAD, POST and an empty body.
• Verify that the normal login page and login submission continue to work.
• Verify that API CORS preflight requests continue to work.

PHP syntax checks passed for the changed route and test files. The automated feature test was not run.

Related Tickets & Packages

• https://processmaker.atlassian.net/browse/FOUR-33655
• https://processmaker.atlassian.net/browse/SCO-35135

ci:deploy

[decisions-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[vladyrichter]

QA server K8S was successfully deployed https://tenant-1.ci-edb8662af6.engk8s.processmaker.net

[CarliPinell]

The code looks good. No observations.

[CarliPinell]

No observations were found