Routes that should return a 405 are returning a 404 when using the CORS snippet

[drum445]

Hi,

Using the tutorial: https://www.slimframework.com/docs/v3/cookbook/enable-cors.html My API now returns 404 instead of a 405 for resources that exist but are not registered for the request type.

Example: A POST request to /customer that has the routes: $app->get('/customer', 'CustomerController:getAll');

Will return a 404 when it should be a 405

It is due to this section of the CORS page: https://github.com/slimphp/Slim-Website/issues/273

[drum445]

Is a workaround but not the cleanest by any means

[odan]

I can confirm that this issue exists in Slim 4.

[odan]

The simple solution just doesn't work as expected. The problem is that adding a (options) catch-all route for all routes will breaks all other explicit defined routes.

Also the Catch-all route to serve a 404 Not Found page doesn't work for request with not allowed methods (405 Method not allowed).

I think the "simple solution" section should be removed from the documentation to prevent further issues like this.

Can I create a PR to remove this section?

[l0gicgate]

The catch-all route to serve 404 is opt-in. You don't have to use it. If you remove that code block you'll get a 405. We can make a note that it's optional.