{"record":{"id":"c607d3c4c274bf54","repo":"phalcon/cphalcon","slug":"invalid-http-method-methods","errorCode":null,"errorMessage":"Invalid HTTP method: {methods}","messagePattern":"Invalid HTTP method: (.+?)","errorType":"exception","errorClass":"Phalcon\\Http\\Request\\Exceptions\\InvalidHttpMethod","httpStatus":null,"severity":"error","filePath":"phalcon/Http/Request.zep","lineNumber":1248,"sourceCode":"    }\n\n    /**\n     * Check if HTTP method match any of the passed methods\n     * When strict is true it checks if validated methods are real HTTP methods\n     *\n     * @todo check the $methods type - refactor this !!\n     *\n     * @param mixed $methods\n     */\n    public function isMethod(var methods, bool strict = false) -> bool\n    {\n        var httpMethod, method;\n\n        let httpMethod = this->getMethod();\n\n        if typeof methods == \"string\" {\n            if unlikely (strict && !this->isValidHttpMethod(methods)) {\n                throw new InvalidHttpMethod(methods);\n            }\n\n            return methods == httpMethod;\n        }\n\n        if typeof methods == \"array\" {\n            for method in methods {\n                if this->isMethod(method, strict) {\n                    return true;\n                }\n            }\n\n            return false;\n        }\n\n        if unlikely strict {\n            throw new InvalidHttpMethod(\"non-string\");\n        }","sourceCodeStart":1230,"sourceCodeEnd":1266,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Http/Request.zep#L1230-L1266","documentation":"Request::isMethod($methods, $strict = true) validates string method names via isValidHttpMethod(), which accepts the known verbs (GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD, TRACE, CONNECT, PURGE). In strict mode an unrecognized verb throws InvalidHttpMethod instead of quietly returning false.","triggerScenarios":"$request->isMethod('PROPFIND', true); isMethod('FOO', true); any string outside the supported verb list with the second argument true.","commonSituations":"WebDAV/CalDAV verbs (PROPFIND, REPORT) reaching strict routes; X-HTTP-Method-Override headers carrying arbitrary values; security-hardened code that turned strict mode on while the app legitimately sees unusual methods.","solutions":["Pass only recognized verbs, upper-cased: GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD, TRACE, CONNECT, PURGE","Call isMethod($method) without strict (default false) when only a boolean comparison is wanted","Pre-validate with $request->isValidHttpMethod($method) and reject unknown verbs before the strict call"],"exampleFix":"// before\nif ($request->isMethod($overrideHeader, true)) { ... } // throws on 'PROPFIND'\n\n// after\n$method = strtoupper((string) $overrideHeader);\nif ($request->isValidHttpMethod($method) && $request->isMethod($method, true)) {\n    // known verb only\n}","handlingStrategy":"validation","validationCode":"$method = strtoupper((string) $method);\nif (!$request->isValidHttpMethod($method)) {\n    throw new \\InvalidArgumentException('Unsupported HTTP verb: ' . $method);\n}\nreturn $request->isMethod($method, true);","typeGuard":"function isKnownHttpMethod(mixed $method): bool\n{\n    return is_string($method)\n        && in_array(strtoupper($method), ['GET','POST','PUT','DELETE','PATCH','OPTIONS','HEAD','TRACE','CONNECT','PURGE'], true);\n}","tryCatchPattern":"try { $ok = $request->isMethod($verb, true); } catch (\\Phalcon\\Http\\Request\\Exceptions\\InvalidHttpMethod $e) { http_response_code(405); exit('Method Not Allowed'); }","preventionTips":["Upper-case method names before comparison","Whitelist X-HTTP-Method-Override values instead of forwarding them raw","Use strict=true only where throwing on unknown verbs is the desired behavior"],"tags":["php","phalcon","http","request-method","validation"],"backgroundTag":"invalid-http-method","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}