fix: respond with 200 to HEAD requests for non-prerendered pages as well

[corneliusroemer]

Changes

Fixes #13079
Fixes #13104
Fixes #13103

Also ensure that HTTP method CONNECT gets origin checked as well (it was previously wrongly omitted because only POST, PUT, PATCH, DELETE were previously checked).

Inspired by @joshmkennedy's PR #13100

Testing

Add test for HEAD getting correct HTTP response 200 (this would have failed prior to his prior)

Docs

Pure bug fix, no docs changes necessary

[changeset-bot]

🦋 Changeset detected

Latest commit: 51b1adb

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codspeed-hq]

CodSpeed Performance Report

Merging #13101 will not alter performance

_{Comparing corneliusroemer:fix-csrf (51b1adb) with main (f392bef)}

Summary

✅ 6 untouched benchmarks

[corneliusroemer]

I don't understand why the test fails, is there maybe another big somewhere in HEAD handling? Or is this in the test utils?

When I test locally, I get 200 for head now.

[joshmkennedy]

You will need to update the fixture. Here is what I did in my pull request. I just added a index.astro to the csrf-check-origin fixture. You could also add a API route for HEAD requests. Not sure which is best.

[ematipico]

@corneliusroemer are still interested in this fix? If you don't have time, let us know, so we can carry over it to the finish line

[ematipico]

I added more tests and removed TRACE because it isn't supported by undici