{"record":{"id":"44b35341d8bc2421","repo":"valyala/fasthttp","slug":"fasthttp-unsupported-http-request-method","errorCode":null,"errorMessage":"fasthttp: unsupported http request method","messagePattern":"fasthttp: unsupported http request method","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"header.go","lineNumber":475,"sourceCode":"// 2. routing (e.g., Host),\n// 3. request modifiers (e.g., controls and conditionals in Section 5 of [RFC7231]),\n// 4. authentication (e.g., see [RFC7235] and [RFC6265]),\n// 5. response control data (e.g., see Section 7.1 of [RFC7231]),\n// 6. determining how to process the payload (e.g., Content-Encoding, Content-Type, Content-Range, and Trailer)\n//\n// Return ErrBadTrailer if contain any forbidden trailers.\nfunc (h *header) AddTrailer(trailer string) error {\n\treturn h.AddTrailerBytes(s2b(trailer))\n}\n\nvar (\n\tErrBadTrailer                    = errors.New(\"fasthttp: contain forbidden trailer\")\n\tErrReadingResponseHeaders        = errors.New(\"fasthttp: error when reading response headers\")\n\tErrReadingResponseTrailer        = errors.New(\"fasthttp: error when reading response trailer\")\n\tErrResponseFirstLineMissingSpace = errors.New(\"fasthttp: cannot find whitespace in the first line of response\")\n\tErrUnexpectedStatusCodeChar      = errors.New(\"fasthttp: unexpected char at the end of status code\")\n\tErrMissingRequestMethod          = errors.New(\"fasthttp: cannot find http request method\")\n\tErrUnsupportedRequestMethod      = errors.New(\"fasthttp: unsupported http request method\")\n\tErrExtraWhitespaceInRequestLine  = errors.New(\"fasthttp: extra whitespace in request line\")\n\tErrEmptyRequestURI               = errors.New(\"fasthttp: requesturi cannot be empty\")\n\tErrDuplicateContentLength        = errors.New(\"fasthttp: duplicate content-length header\")\n\tErrUnsupportedTransferEncoding   = errors.New(\"fasthttp: unsupported transfer-encoding\")\n\tErrNonNumericChars               = errors.New(\"fasthttp: non-numeric chars found\")\n\tErrNeedMore                      = errors.New(\"fasthttp: need more data: cannot find trailing lf\")\n\tErrSmallReadBuffer               = errors.New(\"fasthttp: small read buffer. increase readbuffersize\")\n)\n\n// AddTrailerBytes add Trailer header value for chunked response\n// to indicate which headers will be sent after the body.\n//\n// Use Set to set the trailer header later.\n//\n// Trailers are only supported with chunked transfer.\n// Trailers allow the sender to include additional headers at the end of chunked messages.\n//\n// The following trailers are forbidden:","sourceCodeStart":457,"sourceCodeEnd":493,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/header.go#L457-L493","documentation":"fasthttp validates that the request method is one of the known HTTP methods (GET, POST, PUT, DELETE, HEAD, OPTIONS, CONNECT, TRACE, PATCH, etc.). ErrUnsupportedRequestMethod is returned when the method token does not match any recognized method, either during request parsing or when a method derived from a raw request line cannot be classified.","triggerScenarios":"Parsing a request whose first token is not a valid method (e.g. garbage input, custom verbs sent to a parser that rejects them), or server/client code paths that validate h.Method against the known-method set; requesting with Method set to a typo like \"Getall\".","commonSituations":"Custom RPC-over-HTTP verbs (e.g. 'SUBSCRIBE', 'REPORT' for CalDAV/WebDAV) used with an older fasthttp version whose method table lacks them; typos in SetMethod; fuzzed or hostile traffic to a fasthttp server.","solutions":["Use one of the standard fasthttp.Method* constants for the method.","If you need a nonstandard verb, upgrade fasthttp — newer versions recognize more methods — or bypass validation by writing the raw request bytes yourself.","For WebDAV/CalDAV verbs (PROPFIND, REPORT...), check your fasthttp version supports them; if not, send via net/http or raw connection.","Fix typos: methods are case-sensitive uppercase tokens."],"exampleFix":"// before\nreq.Header.SetMethod(\"getall\") // unsupported\nc.Do(&req, &resp)\n// after\nreq.Header.SetMethod(fasthttp.MethodGet)\nc.Do(&req, &resp)","handlingStrategy":"validation","validationCode":"m := req.Header.Method\nif len(m) == 0 || !isKnownHTTPMethod(m) {\n    return fmt.Errorf(\"unsupported method %q\", m)\n}\n// isKnownHTTPMethod checks against fasthttp's method token table","typeGuard":"func isKnownHTTPMethod(m []byte) bool {\n    switch string(m) {\n    case \"GET\", \"HEAD\", \"POST\", \"PUT\", \"DELETE\", \"CONNECT\", \"OPTIONS\", \"TRACE\", \"PATCH\":\n        return true\n    }\n    return false\n}","tryCatchPattern":"if err := client.Do(req, resp); err == fasthttp.ErrUnsupportedRequestMethod {\n    return fmt.Errorf(\"method %q not accepted: %w\", req.Header.Method, err)\n}","preventionTips":["Only use fasthttp.Method* constants; forbid raw string methods via lint/review.","Check your fasthttp version supports extension verbs (WebDAV) before using them.","Methods are case-sensitive uppercase — validate user-provided methods.","Reject nonstandard verbs at your API edge before they reach the HTTP layer."],"tags":["http","fasthttp","request-validation"],"backgroundTag":"invalid-http-request","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}