HEAD and OPTIONS should not be exposed as actions as discussed in https://github.com/nschlemm/django-rest-framework/commit/a42afa04c38afe25c9032b8ce37b572678b02cf1#commitcomment-3241476

1 files changed, 4 insertions, 0 deletions

diff --git a/rest_framework/views.py b/rest_framework/views.py
index 719df428..c5b89a02 100644
--- a/rest_framework/views.py
+++ b/rest_framework/views.py
@@ -71,6 +71,10 @@ class APIView(View):
         actions = {}
 
         for method in self.allowed_methods:
+            # skip HEAD and OPTIONS
+            if method in ('HEAD', 'OPTIONS'):
+                continue
+
             cloned_request = clone_request(request, method)
             try:
                 self.check_permissions(cloned_request)