{"record":{"id":"29509f21c2e735e3","repo":"denoland/deno","slug":"blob-url-fetch-only-supports-get-method","errorCode":null,"errorMessage":"Blob URL fetch only supports GET method","messagePattern":"Blob URL fetch only supports GET method","errorType":"exception","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"ext/fetch/26_fetch.js","lineNumber":407,"sourceCode":"  // occurs. This applies to every hop, including those reached via redirects.\n  //\n  // Per https://fetch.spec.whatwg.org/#block-bad-port the check only applies\n  // when the URL's scheme is an HTTP(S) scheme, so https bad ports (e.g.\n  // https://example.com:22) are blocked too, while non-HTTP(S) schemes are\n  // left alone. The spec's ALPN note covers *new* protocols negotiated over\n  // TLS; it does not exempt https fetch from the list. This matches Node's\n  // undici (`requestBadPort` gates on `urlIsHttpHttpsScheme`).\n  const url = new URL(req.currentUrl());\n  if (\n    (url.protocol === \"http:\" || url.protocol === \"https:\") &&\n    url.port !== \"\" && BAD_PORTS[url.port] === true\n  ) {\n    return networkError(`Requests to port ${url.port} are blocked`);\n  }\n\n  if (req.blobUrlEntry !== null) {\n    if (req.method !== \"GET\") {\n      throw new TypeError(\"Blob URL fetch only supports GET method\");\n    }\n\n    const body = new InnerBody(req.blobUrlEntry.stream());\n    terminator[abortSignal.add](() => body.error(terminator.reason));\n    processUrlList(req.urlList, req.urlListProcessed);\n\n    return {\n      headerList: [\n        [\"content-length\", String(req.blobUrlEntry.size)],\n        [\"content-type\", req.blobUrlEntry.type],\n      ],\n      status: 200,\n      statusMessage: \"OK\",\n      body,\n      type: \"basic\",\n      url() {\n        if (this.urlList.length == 0) return null;\n        return this.urlList[this.urlList.length - 1];","sourceCodeStart":389,"sourceCodeEnd":425,"githubUrl":"https://github.com/denoland/deno/blob/a961cdec3b1948844414ebeecc697dcad76df2d1/ext/fetch/26_fetch.js#L389-L425","documentation":"A blob: URL references in-memory Blob data, not a network resource. Deno's fetch layer serves blob URLs only for GET requests; any other method (POST, PUT, HEAD, DELETE, ...) is rejected before the blob is even looked up, because a blob URL has no server that could accept a method other than retrieval.","triggerScenarios":"fetch(blobUrl, { method: 'POST' }) or any non-GET method where blobUrl was produced by URL.createObjectURL(blob); passing a Request object whose method is not GET and whose URL is a blob: URL.","commonSituations":"Generic upload helpers that always set method: 'PUT'/'POST' and are later pointed at blob URLs; tests that fake endpoints with blob URLs but keep the real method; browser-ported code where the same restriction exists.","solutions":["Omit method (or use 'GET') when fetching a blob: URL","Read the Blob directly with await blob.arrayBuffer() / blob.text() instead of fetching it","For a real upload, send the blob bytes to the actual http(s): endpoint, not the blob URL"],"exampleFix":"// before\nconst url = URL.createObjectURL(new Blob([bytes]));\nawait fetch(url, { method: \"POST\" }); // TypeError\n\n// after\nconst buf = await blob.arrayBuffer();\nawait fetch(\"https://api.example.com/upload\", { method: \"POST\", body: buf });","handlingStrategy":"validation","validationCode":"const isBlobUrl = (input) =>\n  (typeof input === \"string\" ? input : input.url).startsWith(\"blob:\");\n\nconst method = (init?.method ?? \"GET\").toUpperCase();\nif (isBlobUrl(url) && method !== \"GET\") {\n  const buf = await blob.arrayBuffer(); // read the Blob directly\n  // send buf to the real http(s) endpoint instead\n}","typeGuard":null,"tryCatchPattern":"try {\n  await fetch(url, init);\n} catch (err) {\n  if (err instanceof TypeError && err.message.includes(\"Blob URL\")) {\n    // programmer error: fix the method or bypass the blob URL\n  } else throw err;\n}","preventionTips":["Treat blob: URLs as read-only GET resources","Route uploads through the real HTTP endpoint, never a blob URL","In generic fetch wrappers, special-case blob/data URLs before applying method overrides"],"tags":["fetch","blob","http-method"],"backgroundTag":"unsupported-http-method","analyzedSha":"a961cdec3b1948844414ebeecc697dcad76df2d1","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}