[13.x] Add QUERY route method support

Merged
JO
19d ago
+106-5

Backports Route::query() from #60655 to 13.x.

Route::query('/products/search', SearchProductsController::class);

#60650 was redirected to master because it modified the Registrar contract. This version leaves the contract untouched, so there's no BC break for implementors. The query() / queryJson() testing helpers are already on 13.x (#60662).

Differences from #60655

  • No Registrar contract change.
  • QUERY stays CSRF-verified. #60655 adds QUERY to PreventRequestForgery::isReading(). QUERY is safe by spec, but the route handler is app code carrying a request body, and nothing guarantees it's side-effect free. Browsers do preflight cross-origin QUERY, but that only protects apps whose CORS config is strict; an app allowing credentialed requests from broad origins would expose every web QUERY route. Verifying it like other body-carrying methods keeps CSRF independent of CORS config. Apps can opt out per route with preventRequestForgery(except: [...]).

Notes

  • QUERY is added to Router::$verbs, so Route::any() and Route::redirect() now also match QUERY (same as #60655).
  • route:list detects ANY from Router::$verbs rather than a hardcoded string (same as #60655).