{"record":{"id":"95f51df82844ac6d","repo":"crowdsecurity/crowdsec","slug":"on-method-not-allowed-w","errorCode":null,"errorMessage":"on_method_not_allowed: %w","messagePattern":"on_method_not_allowed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":316,"sourceCode":"\t}\n}\n\nfunc (rv *RequestValidator) LoadSchema(ref string, schema string, opts *SchemaOptions) error {\n\tif ref == \"\" {\n\t\treturn errors.New(\"ref cannot be empty\")\n\t}\n\trv.logger.Debugf(\"loading schema for ref %s\", ref)\n\n\tif _, exists := rv.loaders[ref]; exists {\n\t\treturn fmt.Errorf(\"attempting to load a new schema for existing ref %s\", ref)\n\t}\n\n\toptions := opts.withDefaults()\n\tif err := options.OnRouteNotFound.validate(); err != nil {\n\t\treturn fmt.Errorf(\"on_route_not_found: %w\", err)\n\t}\n\tif err := options.OnMethodNotAllowed.validate(); err != nil {\n\t\treturn fmt.Errorf(\"on_method_not_allowed: %w\", err)\n\t}\n\tif err := options.OnUnsupportedSecurityScheme.validate(); err != nil {\n\t\treturn fmt.Errorf(\"on_unsupported_security_scheme: %w\", err)\n\t}\n\n\tloader := openapi3.NewLoader()\n\trv.loaders[ref] = loader\n\n\tdoc, err := loader.LoadFromData([]byte(schema))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to load schema %s: %w\", ref, err)\n\t}\n\n\t// Is it a valid OpenAPI schema?\n\t// TODO: look into opts, should we expose some of them to the user ?\n\tif err := doc.Validate(loader.Context, openapi3.DisableExamplesValidation()); err != nil {\n\t\treturn fmt.Errorf(\"failed to validate schema %s: %w\", ref, err)\n\t}","sourceCodeStart":298,"sourceCodeEnd":334,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L298-L334","documentation":"LoadSchema validates the OnMethodNotAllowed policy option, which must be exactly \"drop\" or \"ignore\". Any other value makes options.OnMethodNotAllowed.validate() fail, and the error is wrapped as \"on_method_not_allowed: ...\".","triggerScenarios":"Calling LoadSchema with SchemaOptions.OnMethodNotAllowed set to an invalid Policy string (typo, empty string, wrong case), usually from a misconfigured on_method_not_allowed key in the appsec YAML.","commonSituations":"Hand-edited config with a typo; copying policy values from documentation of another product; partially-filled SchemaOptions structs where an empty string was explicitly assigned instead of left unset.","solutions":["Set on_method_not_allowed to exactly \"drop\" or \"ignore\".","Fix casing/typos — values are lowercase and compared with string equality.","Omit the key in YAML (or leave the field unset) so the default is used.","Prefer the exported constants PolicyDrop/PolicyIgnore in Go code instead of raw strings."],"exampleFix":"// before\nopts.OnMethodNotAllowed = api_validation.Policy(\"\")\n\n// after\nopts.OnMethodNotAllowed = api_validation.PolicyIgnore","handlingStrategy":"validation","validationCode":"if p := string(opts.OnMethodNotAllowed); p != \"drop\" && p != \"ignore\" {\n    return fmt.Errorf(\"bad on_method_not_allowed: %q\", p)\n}","typeGuard":"func isPolicy(s string) bool { return s == \"drop\" || s == \"ignore\" }","tryCatchPattern":"if err := rv.LoadSchema(ref, schema, opts); err != nil {\n    if strings.Contains(err.Error(), \"on_method_not_allowed:\") {\n        log.Errorf(\"fix on_method_not_allowed (drop|ignore): %v\", err)\n    }\n    return err\n}","preventionTips":["Only \"drop\" and \"ignore\" are valid policy values","Prefer constants over raw strings","Sanity-check casing after hand-editing YAML","Add a config schema check for on_method_not_allowed at startup"],"tags":["appsec","configuration","enum","policy"],"backgroundTag":"invalid-enum-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}