id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
22797	Base Generic View `_allowed_methods` could accept request args.	Keryn Knight <django@…>	nobody	"Currently, [https://github.com/django/django/blob/e2f142030b81a37e1c3187f5d336dcb6014fd1c0/django/views/generic/base.py#L107 View._allowed_methods] doesn't take into account the potential need for the request to change the availability/discover of methods, if for example the request comes with a token, cookie or whatever that grants additional method access.

`_allowed_methods` is used in the base `View` by the [https://github.com/django/django/blob/e2f142030b81a37e1c3187f5d336dcb6014fd1c0/django/views/generic/base.py#L103 options HTTP verb] and [https://github.com/django/django/blob/e2f142030b81a37e1c3187f5d336dcb6014fd1c0/django/views/generic/base.py#L96 in http_method_not_allowed], both of which could pass on `request, *args, **kwargs` to `_allowed_methods`, and looking at [https://github.com/django/django/search?q=_allowed_methods&ref=cmdform GitHub's results] seems to indicate that's the only place it's used. Meanwhile [https://sourcegraph.com/search?q=%22_allowed_methods%22 Sourcegraph] suggests that the only real public usage (admittedly in a largely depended upon package) downstream is in [https://github.com/tomchristie/django-rest-framework/blob/07cb436d610b0e9b6e60b84412c8d6552c0c55a0/rest_framework/views.py#L106 Django-Rest-Framework]."	New feature	closed	Generic views	dev	Normal	wontfix			Accepted	0	0	0	0	0	0