# allowedMethods

## Purpose

To limit access to controller actions based on the HTTP request method.

## Examples

    class PersonController {
      // action1 may be invoked via a POST
      // action2 has no restrictions
      // action3 may be invoked via a POST or DELETE
      static allowedMethods = [action1:'POST',
                               action3:['POST', 'DELETE']]
      def action1 = { … }
      def action2 = { … }
      def action3 = { … }
    }

## Description

The request method may be inspected inside of a controller action and the application may respond however is appropriate. The code below is a way to prevent the delete action from being invoked using an HTTP-GET.

    class PersonController {
      def delete = {
        if(request.method == 'GET') {
          // redirect to the list action
          redirect(action:list)
        } else {
          // the rest of the delete action goes here
        }
      }
    }

Instead of redirecting to some other action the application may want to return a 405 (Method Not Allowed) error code like this:

    class PersonController {
      def delete = {
        if(request.method == 'GET') {
          response.sendError(405)
        } else {
          // the rest of the delete action goes here
        }
      }
    }

A problem with inspecting the request method inside of the controller action is that this code ends up being repeated in a lot of actions within a controller, in many controllers in an application and in many applications. For specialized application specific handling of invalid requests this may make sense but for the general case the Grails framework provides a simple declarative syntax to help with this problem.

Grails provides a simple declarative syntax to help limit access to controller actions based on the HTTP request method. The optional `allowedMethods` property may be added to a controller to let the framework know which HTTP methods are allowed for controller actions. By default, all request methods are allowed for all controller actions. The `allowedMethods` property only needs to be defined if the controller contains actions that need to be restricted to certain request methods.

The `allowedMethods` property should be assigned a value that is a Map. The keys in the map should be the names of actions that need to be restricted. The value associated with each of those keys may be either a String or a List of Strings. If the value is a String, that String represents the only request method that may be used to invoke that action. If the value is a List of Strings the List represents all of the request methods that may be used to invoke that action. If the specified restrictions are violated then a 405 will be returned in the response.