FOUR-33655: Reject OPTIONS requests to login

routes/web.php

@@ -46,6 +46,7 @@
 use ProcessMaker\Http\Controllers\TestStatusController;
 use ProcessMaker\Http\Controllers\UnavailableController;
 use ProcessMaker\Http\Middleware\NoCache;
+use Symfony\Component\HttpFoundation\Response;
 
 // Public storage route - must be before auth middleware
 Route::get('storage/{path}', [StorageController::class, 'serve'])
@@ -242,6 +243,10 @@
 Broadcast::routes();
 
 // Authentication Routes...
+Route::options('login', function () {
+    return response('', Response::HTTP_METHOD_NOT_ALLOWED)
+        ->header('Allow', 'GET, HEAD, POST');
+});
 Route::get('login', [LoginController::class, 'showLoginForm'])->name('login');
 Route::post('login', [LoginController::class, 'loginWithIntendedCheck']);
 Route::get('logout', [LoginController::class, 'beforeLogout'])->name('logout');
@@ -296,4 +301,4 @@
 Route::get('api/oauth2-redirect.js', function () {
     // Fix l5-swagger and swagger-ui mismatch. See https://github.com/DarkaOnLine/L5-Swagger/issues/648
     return response()->file(base_path('vendor/swagger-api/swagger-ui/dist/oauth2-redirect.js'));
-})->name('oauth2-redirect.js');
+})->name('oauth2-redirect.js');

tests/Feature/RouteTest.php

@@ -3,13 +3,23 @@
 namespace Tests\Feature;
 
 use Illuminate\Routing\Router;
+use Symfony\Component\HttpFoundation\Response;
 use Tests\Feature\Shared\RequestHelper;
 use Tests\TestCase;
 
 class RouteTest extends TestCase
 {
     use RequestHelper;
 
+    public function testLoginDoesNotAllowOptions()
+    {
+        $response = $this->options('/login');
+
+        $response->assertStatus(Response::HTTP_METHOD_NOT_ALLOWED);
+        $response->assertHeader('Allow', 'GET, HEAD, POST');
+        $response->assertContent('');
+    }
+
     /**
      * This this does some basic checks to make sure we converted routes
      * to the correct class-based routes as part of the Laravel 8 upgrade