From 79bbbcebaed08371c3a492577b018ff45965c89e Mon Sep 17 00:00:00 2001
From: Sukikui <nonces-cheviotte0o@icloud.com>
Date: Wed, 11 Mar 2026 15:22:38 +0100
Subject: [PATCH] fix: impose `GET` as API endpoint

---
 .../playercoordsapi/PlayerCoordsAPIClient.java        | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/client/java/fr/sukikui/playercoordsapi/PlayerCoordsAPIClient.java b/src/client/java/fr/sukikui/playercoordsapi/PlayerCoordsAPIClient.java
index 02ba8ff..548a08c 100644
--- a/src/client/java/fr/sukikui/playercoordsapi/PlayerCoordsAPIClient.java
+++ b/src/client/java/fr/sukikui/playercoordsapi/PlayerCoordsAPIClient.java
@@ -164,12 +164,19 @@ private void cleanupServerResources() {
     }
 
     private void handleCoordsRequest(HttpExchange exchange) throws IOException {
-        // Handle CORS preflight request
-        if (exchange.getRequestMethod().equalsIgnoreCase("OPTIONS")) {
+        String method = exchange.getRequestMethod();
+
+        if (method.equalsIgnoreCase("OPTIONS")) {
             sendResponse(exchange, 204, null);
             return;
         }
 
+        if (!method.equalsIgnoreCase("GET")) {
+            exchange.getResponseHeaders().set("Allow", "GET, OPTIONS");
+            sendResponse(exchange, 405, "{\"error\": \"Method not allowed\"}");
+            return;
+        }
+
         // Check if the client is allowed to access (only localhost)
         InetAddress remoteAddress = exchange.getRemoteAddress().getAddress();
         if (remoteAddress == null || !remoteAddress.isLoopbackAddress()) {