play1

It's only "dangerous" because the cache server does not care about headers. I don't see how this could affect security without broken cache server in place. If you are using the framework you should know how the dispatching works. I agree it could be disabled by default tough. It's just an information for the routing system to dispatch a different method on a controller. You could implement a way to use a query string to pass this override too. An API framework does not have to be RESTful. It could work with POST requests only and simulate deletes with something like ?method=delete. Edit: I saw a GitHub comment that actually says it is possible to use query string to override the method in Play 1. https://github.com/playframework/play1/issues/1300#issuecomm... > We've found that although the header is disabled, its still possible to use X

The Play framework (java) also does this: https://github.com/playframework/play/blob/master/framework/... See "renderTemplate(String templateName, Map<String,Object> args)" for a good example.

This is the first controller I opened from their samples[1] : public class Forums extends Application { public static void index() { List forums = Forum.findAll(); long topicsCount = Topic.count(); long postsCount = Post.count(); render(forums, topicsCount, postsCount); } ... } You can't mock out Forum, Topic or Post. You can't inject some type of "FormRepository" or whatever pattern you want to gain some type of control. In Ruby, or most dynamic languages, this wouldn't be a problem, since a class method can (and should) be mocked. Even if a static language allows for that sort of trickery (for example, there are a couple ways to test the above in C#), it's the wrong approach. Dependencies should be injected and thus controlled. I guess you could inject using static setters, but that's just a bad w