Hey, everyone, and welcome back to the Knowledge Portal Video series.
Now, in the past few lectures we have been discussing about various Http methods like Get Post, Head
trace and many others.
So today we'll be speaking about the options method.
So this options method is generally taught at the last of the Http methods.
And the reason why is something that we will understand now.
So let's go ahead and understand the options method with the use case which we have been taking since
quite a while.
So you have a client, this can be a web browser, Telnet Curl or other clients, and you have a server.
Now here within the server you have three files.
Now one is the documentary dot mp4, second is login dot PHP and third is the test dot txt file.
Now a web server has these three files.
Now a client can generally send a request to the web server asking for one of these specific files.
So for example, for documentary MP4, a client may send a get request.
However, when it comes to login dot php, both get and post will be required because client will be
logging in and this is the reason why the username and password fields need to be posted back to the
server.
So for documentary dot mp4 get method is quite useful.
You do not really need a post method.
Similarly for login dot php get and post.
Two methods are very much required when it comes to test dot txt.
Then get method is sufficient enough so depending upon the file which is being served by the web server,
the Http methods which needs to be supported differs a lot.
So when a client sends a request and the server sends a response, the overall methods that will be
supplied over here needs to be controlled.
So as we discussed for documentary dot mp4 get and head is sufficient enough.
Head is also very useful method for login dot php you need get head and post so all three are required
among which get and post should be mandatory.
And when it comes to test you have get in head which are important.
So is there a way for a client to know that for a specific resource, what are the methods which are
supported?
So it might be possible that a web server is only supporting get method for documentary MP4.
So is there any easy way in which we can actually determine this?
And the answer is yes through the options method.
So what really happens in the options method is that option method is used to describe the communication
option for a target resource.
For example, you have a very simple syntax where you have options slash index dot HTML http 1.1.
So what this basically will do is that it will show on what are the methods Http methods which are supported
for this index dot HTML file.
Now this is something that we can send with Telnet as well.
However, we know that the curl is quite simple and thus will be invoking curl where you have curl hyphen
x.
We'll be using the options header followed by the url and hyphen i.
So this will only print the headers.
Perfect.
So let's do one thing.
Let's try this out so that it will become much more simpler for us.
Okay, so what we'll do, we'll run a curl command hyphen x will specify the header or the method,
which will be options.
Followed by the IP address.
In my case, let me put one of the IP address followed by hyphen I.
So now in the response you get, there is a header called allow.
And within this there are the methods.
These are the methods it is saying which is allowed, which is post options get head trace.
So these are the.
Http methods which the web server is allowing.
So there are various other methods like port delete.
So those methods are not allowed for this particular web server.
And if you might want to know which is the web server, it is running, it is running Apache 2.4.6.
So similarly, as a system administrator might actually decide to not allow the options header at all.
So let me give you an example.
When you talk about Nginx as a web server, Nginx does not allow this options header at all, so it
will not accept it at all.
So let me show you.
I'll say Dexter dot Labs dot n hyphen I and now you see it is returning back saying it is not allowed.
So options header is not allowed in nginx by default.
The reason why is because of the security perspective.
Ideally, this is why.
Do you want an outsider to know what is allowed, what is not allowed in your web server?
And this is the reason why Nginx does not support it by default.
Apache does it.
And this is the reason why I had a test server created so that we can check the options header in our
Apache based web server.
Now one important thing to remember is that even if you are using Apache, make sure that you do not
really allow options for the world to know on what are the Http methods which are allowed in your web
server.
Along with that, you can control, let's say for example for login dot PHP, you can control on what
are the Http methods which will be allowed Similarly for if it is a documentary MP4, you can control
which Http methods which will be allowed in that specific resource.
So this is it.
About this lecture.
I hope you understood the basics about the options method and I look forward to see you in the next
lecture.