{"record":{"id":"b637dfe7b6596d91","repo":"symfony/http-foundation","slug":"invalid-http-method-override","errorCode":null,"errorMessage":"Invalid HTTP method override.","messagePattern":"Invalid HTTP method override\\.","errorType":"exception","errorClass":"SuspiciousOperationException","httpStatus":400,"severity":"error","filePath":"Request.php","lineNumber":1302,"sourceCode":"            $method = $this->request->get('_method', $this->query->get('_method', 'POST'));\n        }\n\n        if (!\\is_string($method)) {\n            return $this->method;\n        }\n\n        $method = strtoupper($method);\n\n        if (\\in_array($method, ['GET', 'HEAD', 'CONNECT', 'TRACE'], true)) {\n            return $this->method;\n        }\n\n        if (self::$allowedHttpMethodOverride && !\\in_array($method, self::$allowedHttpMethodOverride, true)) {\n            return $this->method;\n        }\n\n        if (\\strlen($method) !== strspn($method, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ')) {\n            throw new SuspiciousOperationException('Invalid HTTP method override.');\n        }\n\n        return $this->method = $method;\n    }\n\n    /**\n     * Gets the \"real\" request method.\n     *\n     * @see getMethod()\n     */\n    public function getRealMethod(): string\n    {\n        return strtoupper($this->server->get('REQUEST_METHOD', 'GET'));\n    }\n\n    /**\n     * Gets the mime type associated with the format.\n     */","sourceCodeStart":1284,"sourceCodeEnd":1320,"githubUrl":"https://github.com/symfony/http-foundation/blob/5aea19cd678fa4140f6108406f1096de5e9ed6e4/Request.php#L1284-L1320","documentation":"When a method override header (X-HTTP-Method-Override) is present, Request::getMethod() accepts only uppercase A-Z strings. An override value containing anything else (lowercase letters, spaces, digits, symbols) throws SuspiciousOperationException('Invalid HTTP method override.') to block malformed or malicious override headers.","triggerScenarios":"Client sends header X-HTTP-Method-Override: 'patch' (lowercase), 'DELETE ', 'PUT;inject', or any value not strictly [A-Z]+; proxied requests where middleware adds a badly cased override header.","commonSituations":"JS clients or HTTP libraries setting the override header in lowercase; API gateways/interceptors normalizing methods incorrectly; security scans fuzzing the override header.","solutions":["Send the override value in uppercase: X-HTTP-Method-Override: PATCH.","Sanitize/normalize the header in middleware: strtoupper(trim($value)) before it reaches the request.","Ensure self::$allowedHttpMethodOverride only lists uppercase method names ('PUT','DELETE',...).","Catch SuspiciousOperationException and return 400 for bad override values."],"exampleFix":"// before (client)\nheaders: { 'X-HTTP-Method-Override': 'delete' }\n\n// after\nheaders: { 'X-HTTP-Method-Override': 'DELETE' }","handlingStrategy":"validation","validationCode":"$override = $request->headers->get('X-HTTP-Method-Override', '');\nif ($override !== '' && !preg_match('/^[A-Z]+$/', $override)) {\n    return new Response('Invalid HTTP method override', 400);\n}","typeGuard":null,"tryCatchPattern":"use Symfony\\Component\\HttpFoundation\\Exception\\SuspiciousOperationException;\n\ntry {\n    $method = $request->getMethod();\n} catch (SuspiciousOperationException $e) {\n    return new Response('Invalid HTTP method override', 400);\n}","preventionTips":["Always send X-HTTP-Method-Override values fully uppercase.","Normalize the header with strtoupper(trim(...)) in gateway/middleware code.","Restrict overrides to a whitelist of uppercase methods.","Fuzz-test override headers in CI to catch regressions."],"tags":["http","method-override","security","symfony"],"backgroundTag":"invalid-argument-value","analyzedSha":"5aea19cd678fa4140f6108406f1096de5e9ed6e4","analyzedAt":"2026-09-13T01:52:22.855Z","contentChangedAt":"2026-09-13T01:52:22.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}