Kirby Panel not editable with Bunny CDN

[beromir]

Hey,

I have a problem with the Kirby Panel and Bunny CDN.
Every time I try to edit content on a page, for example switching a toggle, a request is sent to lock the page.

This request is a POST request with the x-http-method-override header set to PATCH. The response I get is a 404 No route found for path: "pages/test/lock" and request method: "POST.
The Bunny.net support responded that they strip the header internally before passing it back to the origin.

Is there a way to send the request as PATCH?

[distantnative]

The source of your issue is here: kirby/panel/src/api/request.js at main · getkirby/kirby · GitHub

Where Kirby converts those request to POST requests and adds the x-http-method-override header. The problem is that this was necessary as many servers will block PATCH requests etc.

Not sure yet if/how we can handle servers that allow those but strip the header instead. Maybe @lukasbestle has an idea.

[beromir]

Yes, I have seen the issue on GitHub. Would be nice to have maybe a config setting for that.

[lukasbestle]

At the moment we hardcode the methodOverwrite option to true. What we could do is to build a test route that is called once when the Panel loads, e.g. PATCH /api/system/method-test. The backend would return the request method it received. If the Panel gets a successful response with the correct method, we can set methodOverwrite to false, otherwise to true.

(Probably the option should rather be called methodOverride)

[distantnative]

I think I’d rather go for the config option then. Having that call on every Panel (re-)load doesn’t feel great to me (also considering the niche need for it).

[beromir]

In my opinion, the config option would also be the best solution. But it might also be nice to have a area in the System Panel view to check these things manually or automatically when you visit the system view.

[distantnative]

That’s true. I figure we could probably add a check to the tests that the system view runs - and if it fails show a warning with a link to the docs for the new config option.

[lukasbestle]

Sounds great. We could even switch the default to proper HTTP methods and only offer the method override header as an option for those who need it (considering that the HTTP methods are standards-compliant and most server setups should be supporting them).

[ImaCrea]

Hi there, I’ve encountered the same issue with Bunny CDN today on kirby 5.5.3.

I tried to put this in config file

return [
  'api' => [
    'methodOverride' => false
  ]
];

but nothing seemed to change.

In the end I fixed it by disabling ‘Forward host header’ in CDN>General>Origin settings.

[ImaCrea]

Well I thought it worked as I didn’t see the error triggered anymore when changing state of a checkbox but actually it’s still blocked if I try to save a change.

I’ve tried to add that edge rule to bunny and then purge cache but doesn’t seem to work neither

I’ve also tried to set methodOverride to false or true in the config (as I don’t really grasp fully what it does) but it didn’t seem to fix the issue.

---

[EDIT]

So it turns out that I needed to broader URLs in condition AND to bypass WAF (that I activated in shield) as saving change was detected as an application attack :

So here’s the working edge rule I found :