{"record":{"id":"299982f5568a6c70","repo":"phalcon/cphalcon","slug":"invalid-http-method-non-string","errorCode":null,"errorMessage":"Invalid HTTP method: non-string","messagePattern":"Invalid HTTP method: non-string","errorType":"exception","errorClass":"Phalcon\\Http\\Request\\Exceptions\\InvalidHttpMethod","httpStatus":null,"severity":"error","filePath":"phalcon/Http/Request.zep","lineNumber":1265,"sourceCode":"            if unlikely (strict && !this->isValidHttpMethod(methods)) {\n                throw new InvalidHttpMethod(methods);\n            }\n\n            return methods == httpMethod;\n        }\n\n        if typeof methods == \"array\" {\n            for method in methods {\n                if this->isMethod(method, strict) {\n                    return true;\n                }\n            }\n\n            return false;\n        }\n\n        if unlikely strict {\n            throw new InvalidHttpMethod(\"non-string\");\n        }\n\n        return false;\n    }\n\n    /**\n     * Checks whether HTTP method is OPTIONS.\n     * if _SERVER[\"REQUEST_METHOD\"]===\"OPTIONS\"\n     */\n    public function isOptions() -> bool\n    {\n        return this->getMethod() === self::METHOD_OPTIONS;\n    }\n\n    /**\n     * Checks whether HTTP method is PATCH.\n     * if _SERVER[\"REQUEST_METHOD\"]===\"PATCH\"\n     */","sourceCodeStart":1247,"sourceCodeEnd":1283,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Http/Request.zep#L1247-L1283","documentation":"Request::isMethod() with strict=true throws InvalidHttpMethod('non-string') when $methods is neither a string nor an array (null, int, object). The array branch recurses into isMethod($method, $strict) per element, so an array containing a non-string element throws the same error. Strict mode demands every method name be a string.","triggerScenarios":"isMethod(null, true) - e.g. $method = $request->getHeader('X-HTTP-Method') when the header is absent; isMethod(123, true); isMethod(['GET', null], true) via the per-element recursion.","commonSituations":"Reading an optional override header that may be missing; passing unvalidated JSON/body values into isMethod; refactors that changed a variable from string to nullable.","solutions":["Guard the input: only call with is_string($methods) or a pure string array","Default the variable: $method = $request->getHeader('X-HTTP-Method') ?? $request->getMethod();","Drop strict mode (pass false) when the input cannot be trusted to be a valid verb name"],"exampleFix":"// before\n$method = $request->getHeader('X-HTTP-Method'); // null when absent\n$request->isMethod($method, true); // throws 'non-string'\n\n// after\n$method = $request->getHeader('X-HTTP-Method') ?? $request->getMethod();\n$request->isMethod($method, true);","handlingStrategy":"type-guard","validationCode":"if (!is_string($methods) && !is_array($methods)) {\n    $methods = $request->getMethod(); // sensible default when e.g. header absent\n}\n$request->isMethod($methods, true);","typeGuard":"function isMethodNameList(mixed $methods): bool\n{\n    if (is_string($methods)) {\n        return true;\n    }\n    return is_array($methods) && !in_array(false, array_map('is_string', $methods), true);\n}","tryCatchPattern":"try { $request->isMethod($methods, true); } catch (\\Phalcon\\Http\\Request\\Exceptions\\InvalidHttpMethod $e) { // 'non-string' means bad input -> client error\n    http_response_code(400);\n    exit('Invalid method parameter');\n}","preventionTips":["Default nullable header reads: $header ?? $request->getMethod()","Never feed raw body or JSON values into isMethod","Unit-test the override-header-absent path"],"tags":["php","phalcon","http","request-method","type-safety"],"backgroundTag":"invalid-http-method","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}