{"record":{"id":"1bd563975d3de17f","repo":"remix-run/remix","slug":"invalid-request-method-in-bypass-pattern-json-st","errorCode":null,"errorMessage":"invalid request method in bypass pattern ${JSON.stringify(pattern)}","messagePattern":"invalid request method in bypass pattern (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/cop-middleware/src/lib/cop.ts","lineNumber":237,"sourceCode":"\nfunction serializeOrigin(origin: URL): string {\n  return `${origin.protocol}//${origin.host}`\n}\n\nfunction parseBypassPattern(pattern: string): BypassPattern {\n  let trimmedPattern = pattern.trim()\n  if (trimmedPattern === '') {\n    throw new Error('bypass pattern must not be empty')\n  }\n\n  let method: RequestMethod | null = null\n  let pathname = trimmedPattern\n  let methodPattern = /^([A-Z]+)\\s+(.+)$/.exec(trimmedPattern)\n\n  if (methodPattern != null && methodPattern[2].startsWith('/')) {\n    let maybeMethod = methodPattern[1]\n    if (!isRequestMethod(maybeMethod)) {\n      throw new Error(`invalid request method in bypass pattern ${JSON.stringify(pattern)}`)\n    }\n\n    method = maybeMethod\n    pathname = methodPattern[2]\n  }\n\n  if (!pathname.startsWith('/')) {\n    throw new Error(`invalid bypass pattern ${JSON.stringify(pattern)}: path must start with \"/\"`)\n  }\n\n  if (pathname.includes('?') || pathname.includes('#')) {\n    throw new Error(\n      `invalid bypass pattern ${JSON.stringify(pattern)}: query strings and fragments are not supported`,\n    )\n  }\n\n  let matchesSubtree = pathname.endsWith('/')\n  let normalizedPathname =","sourceCodeStart":219,"sourceCodeEnd":255,"githubUrl":"https://github.com/remix-run/remix/blob/9696913134be3a4423513d2775f7b31d6917c049/packages/cop-middleware/src/lib/cop.ts#L219-L255","documentation":"A bypass pattern may start with an uppercase HTTP method ('GET /api'), but only recognized request methods are accepted. If the leading token looks like a method but isn't a valid one, this error is thrown.","triggerScenarios":"addInsecureBypassPattern('FETCH /api/x'), 'get /api' (lowercase — note the regex requires uppercase, so lowercase 'get' is treated as a pathname instead and won't trigger this), or a path of uppercase words followed by a path, e.g. 'ADMIN /panel'.","commonSituations":"Typos in method names; assuming custom methods are allowed; using 'ALL' or '*' hoping to match any method.","solutions":["Use a standard method name in uppercase: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS","Omit the method entirely to match all methods for that path","Fix the typo (e.g. 'POST /api/x')"],"exampleFix":"// before\ncop.addInsecureBypassPattern('FETCH /api/x')\n// after\ncop.addInsecureBypassPattern('GET /api/x')","handlingStrategy":"type-guard","validationCode":"const METHODS = ['GET','POST','PUT','PATCH','DELETE','HEAD','OPTIONS']\nlet m = /^([A-Z]+)\\s+/.exec(pattern)\nif (m && !METHODS.includes(m[1])) throw new Error('bad method in pattern')","typeGuard":"function isValidPattern(p: string): boolean {\n  let m = /^([A-Z]+)\\s+(\\/.+)$/.exec(p)\n  return m == null || ['GET','POST','PUT','PATCH','DELETE','HEAD','OPTIONS'].includes(m[1])\n}","tryCatchPattern":null,"preventionTips":["Use only standard uppercase HTTP method names","Omit the method to match all methods","Copy patterns from documented examples"],"tags":["cop-middleware","bypass","http-method","validation"],"backgroundTag":"invalid-pattern-config","analyzedSha":"9696913134be3a4423513d2775f7b31d6917c049","analyzedAt":"2026-08-27T19:55:01.024Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}