{"action":"closed","issue":{"url":"https://api.github.com/repos/yiisoft/yii2/issues/10949","repository_url":"https://api.github.com/repos/yiisoft/yii2","labels_url":"https://api.github.com/repos/yiisoft/yii2/issues/10949/labels{/name}","comments_url":"https://api.github.com/repos/yiisoft/yii2/issues/10949/comments","events_url":"https://api.github.com/repos/yiisoft/yii2/issues/10949/events","html_url":"https://github.com/yiisoft/yii2/issues/10949","id":135946303,"number":10949,"title":"Yii2 RESTful response to OPTIONS ignores only/except, does not list DELETE","user":{"login":"matthewdaize","id":3209700,"avatar_url":"https://avatars.githubusercontent.com/u/3209700?v=3","gravatar_id":"","url":"https://api.github.com/users/matthewdaize","html_url":"https://github.com/matthewdaize","followers_url":"https://api.github.com/users/matthewdaize/followers","following_url":"https://api.github.com/users/matthewdaize/following{/other_user}","gists_url":"https://api.github.com/users/matthewdaize/gists{/gist_id}","starred_url":"https://api.github.com/users/matthewdaize/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matthewdaize/subscriptions","organizations_url":"https://api.github.com/users/matthewdaize/orgs","repos_url":"https://api.github.com/users/matthewdaize/repos","events_url":"https://api.github.com/users/matthewdaize/events{/privacy}","received_events_url":"https://api.github.com/users/matthewdaize/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-02-24T03:53:06Z","updated_at":"2016-02-24T06:46:14Z","closed_at":"2016-02-24T06:46:14Z","body":"Yii2 supports `OPTIONS` to return back the available RESTful interactions on a route. it returns a response header `Allow` with the available commands.\r\n\r\nThis however displays commands which are not allowed (and omits DELETE) due to `only` or `except` within the defined routes. I also cannot find anywhere in the documentations that says this is intended behaviour, so I'm raising this issue incase of this being unintended operation. Please flag this issue if my assumption is incorrect.\r\n\r\n## Steps to reproduce:\r\n\r\nPerform an OPTIONS on `http://<fqdn>/users`, response header:\r\n   `Allow: GET, POST, HEAD, OPTIONS`\r\n\r\nNow, configure the UrlRoute so that:\r\n   `['class' => 'yii\\rest\\UrlRule', 'controller' => ['v1/user'], 'except' => ['delete']]`\r\nPerform the same OPTIONS on `http://<fqdn>/users`, response header:\r\n   `Allow: GET, POST, HEAD, OPTIONS`\r\nAttempt a `GET` and it works as expected returning a 200.\r\nAttempt a `DELETE` and it returns `405: Method Not Allowed` as expected.\r\n\r\nLastly, configure the UrlRoute so that:\r\n   `['class' => 'yii\\rest\\UrlRule', 'controller' => ['v1/user'], 'only' => ['delete', 'options']]`\r\nPerform the same OPTIONS on `http://<fqdn>/users`, response header:\r\n   `Allow: GET, POST, HEAD, OPTIONS`\r\nAttempt a `GET` and it returns `405: Method Not Allowed` as expected.\r\nAttempt a `DELETE` and it works as expected returning a 200.\r\n"}}