Incorrectly removes ‘Allow’ header from HTTP 204 response

[andersk]

In this application, Tornado (6.0.3) filters the Allow header out of the 204 response to an OPTIONS request, while the misspelled Alloww header is passed through. RFC 7231 §7.4.1 is clear that an Allow header MAY be sent on any response, and §4.3.7 says that it SHOULD be sent if applicable in response to an OPTIONS request, so Tornado should not filter it out.

import tornado.ioloop
import tornado.web

class MainHandler(tornado.web.RequestHandler):
    def get(self):
        self.write("Hello, world")

    def options(self):
        self.set_header("Allow", "GET, OPTIONS")
        self.set_header("Alloww", "GET, OPTIONS")
        self.set_status(204)
        self.finish()

if __name__ == "__main__":
    app = tornado.web.Application([(r"/", MainHandler)])
    app.listen(8888)
    tornado.ioloop.IOLoop.current().start()

$ curl -i -X OPTIONS http://localhost:8888
HTTP/1.1 204 No Content
Server: TornadoServer/6.0.3
Date: Mon, 12 Aug 2019 01:49:10 GMT
Alloww: GET, OPTIONS