{"record":{"id":"24cb8fce89c561e2","repo":"k3s-io/k3s","slug":"method-not-allowed-24cb8f","errorCode":null,"errorMessage":"method not allowed","messagePattern":"method not allowed","errorType":"http","errorClass":null,"httpStatus":405,"severity":"warning","filePath":"pkg/server/handlers/token.go","lineNumber":38,"sourceCode":"\ntype TokenRotateRequest struct {\n\tNewToken *string `json:\"newToken,omitempty\"`\n}\n\nfunc getServerTokenRequest(req *http.Request) (TokenRotateRequest, error) {\n\tb, err := io.ReadAll(req.Body)\n\tif err != nil {\n\t\treturn TokenRotateRequest{}, err\n\t}\n\tresult := TokenRotateRequest{}\n\terr = json.Unmarshal(b, &result)\n\treturn result, err\n}\n\nfunc TokenRequest(ctx context.Context, control *config.Control) http.Handler {\n\treturn http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {\n\t\tif req.Method != http.MethodPut {\n\t\t\tutil.SendError(errors.New(\"method not allowed\"), resp, req, http.StatusMethodNotAllowed)\n\t\t\treturn\n\t\t}\n\t\tvar err error\n\t\tsTokenReq, err := getServerTokenRequest(req)\n\t\tlogrus.Debug(\"Received token request\")\n\t\tif err != nil {\n\t\t\tutil.SendError(err, resp, req, http.StatusBadRequest)\n\t\t\treturn\n\t\t}\n\t\tif err = tokenRotate(ctx, control, *sTokenReq.NewToken); err != nil {\n\t\t\tutil.SendErrorWithID(err, \"token\", resp, req, http.StatusInternalServerError)\n\t\t\treturn\n\t\t}\n\t\tresp.WriteHeader(http.StatusOK)\n\t})\n}\n\nfunc WriteToken(token, file, certs string) error {","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/server/handlers/token.go#L20-L56","documentation":"TokenRequest in pkg/server/handlers/token.go serves /v1-k3s/token, the endpoint behind 'k3s token rotate'. It accepts only HTTP PUT; any other verb is rejected with HTTP 405 'method not allowed' before the JSON body is parsed.","triggerScenarios":"GET/POST to /v1-k3s/token - e.g. curl without -X PUT, a probe, or custom scripts using the wrong method.","commonSituations":"Manual token-rotation attempts via curl; monitoring scanning the supervisor port; wrappers that default to GET.","solutions":["Use PUT with a JSON body: curl -sk -X PUT -d '{\"newToken\":\"...\"}' https://server:6443/v1-k3s/token.","Prefer the CLI: 'k3s token rotate' (optionally 'k3s token rotate --new-token <token>').","Exclude /v1-k3s/token from generic GET-based checks."],"exampleFix":"# before: 405\ncurl -sk https://127.0.0.1:6443/v1-k3s/token\n\n# after: accepted\ncurl -sk -X PUT https://127.0.0.1:6443/v1-k3s/token -d '{\"newToken\":\"\"}'","handlingStrategy":"validation","validationCode":"// Guard the verb before calling the token endpoint\nif req.Method != http.MethodPut {\n    return errors.New(\"token endpoint requires PUT\")\n}","typeGuard":null,"tryCatchPattern":"if resp.StatusCode == http.StatusMethodNotAllowed {\n    // re-send as PUT with a JSON body, or use 'k3s token rotate'\n}","preventionTips":["Use 'k3s token rotate' rather than hand-rolled HTTP.","Mutation endpoints on the supervisor are PUT-only by convention - script accordingly."],"tags":["http","k3s","method-not-allowed","token","authentication"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}