diff --git a/src/Framework/Framework/Hosting/DotvvmPresenter.cs b/src/Framework/Framework/Hosting/DotvvmPresenter.cs index fdcf00c59b..5057cb515f 100644 --- a/src/Framework/Framework/Hosting/DotvvmPresenter.cs +++ b/src/Framework/Framework/Hosting/DotvvmPresenter.cs @@ -478,11 +478,8 @@ async Task RespondWithStaticCommandValidationFailure(ActionInfo action, IDotvvmR async Task ValidateSecFetchHeaders(IDotvvmRequestContext context) { var route = context.Route?.RouteName; - var isPost = context.HttpContext.Request.Method switch { - "POST" => true, - "GET" => false, - _ => throw new NotSupportedException() - }; + var requestType = DotvvmRequestContext.DetermineRequestType(context.HttpContext); + var isPost = requestType is DotvvmRequestType.Command or DotvvmRequestType.StaticCommand; var checksAllowed = (isPost ? SecurityConfiguration.VerifySecFetchForCommands : SecurityConfiguration.VerifySecFetchForPages).IsEnabledForRoute(route); var dest = context.HttpContext.Request.Headers["Sec-Fetch-Dest"]; var site = context.HttpContext.Request.Headers["Sec-Fetch-Site"]; diff --git a/src/Framework/Framework/Hosting/DotvvmRequestContext.cs b/src/Framework/Framework/Hosting/DotvvmRequestContext.cs index 3a72192853..a0291b62e8 100644 --- a/src/Framework/Framework/Hosting/DotvvmRequestContext.cs +++ b/src/Framework/Framework/Hosting/DotvvmRequestContext.cs @@ -171,6 +171,9 @@ public static DotvvmRequestType DetermineRequestType(IHttpContext context) { return DotvvmRequestType.Command; } + // Unknown POST request is treated as a Navigate request + // it is useful for submitting classic