Fix serve_dir method not allowed handling when no fallback is configured (#587)

soerenmeier · web-flow · commit f0b3bb6dcde9 · 2026-05-06T15:51:13.000-07:00
Fixes a bug in `ServeDir` where non-GET/HEAD requests were incorrectly
processed when `call_fallback_on_method_not_allowed` is enabled but no
fallback service is provided.
diff --git a/tower-http/src/services/fs/serve_dir/mod.rs b/tower-http/src/services/fs/serve_dir/mod.rs
@@ -321,9 +321,9 @@ impl<F> ServeDir<F> {
                         inner: future::call_fallback(fallback, req),
                     };
                 }
-            } else {
-                return ResponseFuture::method_not_allowed();
             }
+
+            return ResponseFuture::method_not_allowed();
         }
 
         // `ServeDir` doesn't care about the request body but the fallback might. So move out the
diff --git a/tower-http/src/services/fs/serve_dir/tests.rs b/tower-http/src/services/fs/serve_dir/tests.rs
@@ -791,6 +791,21 @@ async fn calling_fallback_on_not_allowed() {
     assert_eq!(body, "from fallback /doesnt-exist");
 }
 
+#[tokio::test]
+async fn method_not_allowed_without_fallback() {
+    let svc = ServeDir::new("..").call_fallback_on_method_not_allowed(true);
+
+    let req = Request::builder()
+        .method(Method::POST)
+        .uri("/README.md")
+        .body(Body::empty())
+        .unwrap();
+    let res = svc.oneshot(req).await.unwrap();
+
+    assert_eq!(res.status(), StatusCode::METHOD_NOT_ALLOWED);
+    assert_eq!(res.headers()[ALLOW], "GET,HEAD");
+}
+
 #[tokio::test]
 async fn with_fallback_svc_and_not_append_index_html_on_directories() {
     async fn fallback<B>(req: Request<B>) -> Result<Response<Body>, Infallible> {

Original file line number	Diff line number	Diff line change
`@@ -321,9 +321,9 @@ impl<F> ServeDir<F> {`
`321`	`321`	`inner: future::call_fallback(fallback, req),`
`322`	`322`	`};`
`323`	`323`	`}`
`324`		`- } else {`
`325`		`- return ResponseFuture::method_not_allowed();`
`326`	`324`	`}`
	`325`	`+`
	`326`	`+ return ResponseFuture::method_not_allowed();`
`327`	`327`	`}`
`328`	`328`
`329`	`329`	// `ServeDir` doesn't care about the request body but the fallback might. So move out the