{"record":{"id":"17f5e1a21b499150","repo":"projectdiscovery/nuclei","slug":"invalid-http-method-verb-s","errorCode":null,"errorMessage":"Invalid HTTP method verb: %s","messagePattern":"Invalid HTTP method verb: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/protocols/http/http_method_types.go","lineNumber":72,"sourceCode":"}\n\n// GetSupportedHTTPMethodTypes returns list of supported types\nfunc GetSupportedHTTPMethodTypes() []HTTPMethodType {\n\tvar result []HTTPMethodType\n\tfor index := HTTPMethodType(1); index < limit; index++ {\n\t\tresult = append(result, index)\n\t}\n\treturn result\n}\n\nfunc toHTTPMethodTypes(valueToMap string) (HTTPMethodType, error) {\n\tnormalizedValue := normalizeValue(valueToMap)\n\tfor key, currentValue := range HTTPMethodMapping {\n\t\tif normalizedValue == currentValue {\n\t\t\treturn key, nil\n\t\t}\n\t}\n\treturn -1, errors.New(\"Invalid HTTP method verb: \" + valueToMap)\n}\n\nfunc normalizeValue(value string) string {\n\treturn strings.TrimSpace(strings.ToUpper(value))\n}\n\nfunc (t HTTPMethodType) String() string {\n\treturn HTTPMethodMapping[t]\n}\n\n// HTTPMethodTypeHolder is used to hold internal type of the HTTP Method\ntype HTTPMethodTypeHolder struct {\n\tMethodType HTTPMethodType `mapping:\"true\"`\n}\n\nfunc (holder HTTPMethodTypeHolder) String() string {\n\treturn holder.MethodType.String()\n}","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/protocols/http/http_method_types.go#L54-L90","documentation":"The `method:` field of an HTTP request resolves through toHTTPMethodTypes, which trims and uppercases the value then matches it against HTTPMethodMapping. Supported verbs are GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH, PURGE and DEBUG; anything else fails template compilation with this message.","triggerScenarios":"A typo like `method: GETS` / `method: gett`, or an unsupported custom verb such as `method: PROPFIND` or `method: REPORT` (WebDAV-style) in the `method:` field. Case is fine (normalized), the word itself must be in the table.","commonSituations":"Expecting arbitrary-verb support via the method field; porting curl commands with unusual verbs; typos during hand-editing.","solutions":["Fix the verb to one of GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH, PURGE, DEBUG","For arbitrary/custom verbs, use a raw request block where the verb is written literally on the request line"],"exampleFix":"# before\nhttp:\n  - method: PROPFIND\n    path: [\"/\"]\n\n# after\nhttp:\n  - raw:\n      - |\n        PROPFIND / HTTP/1.1\n        Host: {{Hostname}}","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"func isValidHTTPMethod(v string) bool {\n    _, ok := http.HTTPMethodMapping[...] // caller-side equivalent:\n}\n// simpler caller-side set:\nvar validMethods = map[string]bool{\"GET\":true,\"HEAD\":true,\"POST\":true,\"PUT\":true,\n  \"DELETE\":true,\"CONNECT\":true,\"OPTIONS\":true,\"TRACE\":true,\"PATCH\":true,\"PURGE\":true,\"DEBUG\":true}\n\nfunc isValidHTTPMethod(method string) bool {\n    return validMethods[strings.ToUpper(strings.TrimSpace(method))]\n}","tryCatchPattern":null,"preventionTips":["Limit `method:` to GET/HEAD/POST/PUT/DELETE/CONNECT/OPTIONS/TRACE/PATCH/PURGE/DEBUG","For custom verbs (WebDAV etc.), write them literally in a raw request instead of the method field","Validate templates with nuclei -validate to catch enum errors at authoring time"],"tags":["http","enum","template","method"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}