{"record":{"id":"cddf44a8622bfa47","repo":"dromara/Sa-Token","slug":"method-method","errorCode":null,"errorMessage":"非法请求 Method：{method}","messagePattern":"非法请求 Method：(.+?)","errorType":"exception","errorClass":"FirewallCheckException","httpStatus":null,"severity":"error","filePath":"sa-token-core/src/main/java/cn/dev33/satoken/strategy/hooks/SaFirewallCheckHookForHttpMethod.java","lineNumber":86,"sourceCode":"    public void resetConfig(boolean isCheckMethod, String... methods) {\n        this.isCheckMethod = isCheckMethod;\n        this.allowMethods.clear();\n        this.allowMethods.addAll(Arrays.asList(methods));\n    }\n\n    /**\n     * 执行的方法\n     *\n     * @param req 请求对象\n     * @param res 响应对象\n     * @param extArg 预留扩展参数\n     */\n    @Override\n    public void execute(SaRequest req, SaResponse res, Object extArg) {\n        if(isCheckMethod) {\n            String method = req.getMethod();\n            if( ! allowMethods.contains(method) ) {\n                throw new FirewallCheckException(\"非法请求 Method：\" + method);\n            }\n        }\n    }\n\n}\n","sourceCodeStart":68,"sourceCodeEnd":92,"githubUrl":"https://github.com/dromara/Sa-Token/blob/ac2c7f6e94a78573cf0bcb932dd8b04e68fad189/sa-token-core/src/main/java/cn/dev33/satoken/strategy/hooks/SaFirewallCheckHookForHttpMethod.java#L68-L92","documentation":"When sa-token.firewall.check-method is enabled, the HTTP Method firewall hook requires req.getMethod() to be present in the configured allowMethods collection, otherwise it throws FirewallCheckException naming the method. The method name is case-sensitive: the raw servlet method is uppercase, so lowercase entries in your config list will never match.","triggerScenarios":"Enabling method-check with allow-methods=[GET,POST] while the frontend issues PUT/DELETE/PATCH/OPTIONS requests; preflight OPTIONS from browsers being blocked; a lowercase 'get' in the config list.","commonSituations":"Enabling the method whitelist on a REST API that also needs OPTIONS for CORS preflight; forgetting DELETE when adding a delete endpoint; config lists written lowercase.","solutions":["Add the blocked method (uppercase) to sa-token.firewall.allow-methods, e.g. [GET, POST, PUT, DELETE, OPTIONS]","Always include OPTIONS when the API is called cross-origin from browsers","Or turn the check off (method-check=false) if you cannot enumerate methods"],"exampleFix":"# before\nsa-token:\n  firewall:\n    check-method: true\n    allow-methods: [GET, POST]\n\n# after\nsa-token:\n  firewall:\n    check-method: true\n    allow-methods: [GET, POST, PUT, DELETE, PATCH, OPTIONS]","handlingStrategy":"validation","validationCode":"String m = req.getMethod().toUpperCase(Locale.ROOT);\nif (SaManager.getConfig().getFirewall().getIsCheckMethod()\n        && !SaManager.getConfig().getFirewall().getAllowMethods().contains(m)) {\n    // reject 405 before sa-token firewall\n}","typeGuard":null,"tryCatchPattern":"try {\n    chain.doFilter(req, res);\n} catch (FirewallCheckException e) {\n    res.setStatus(405).setHeader(\"Allow\", \"GET, POST, OPTIONS\");\n}","preventionTips":["Write allow-methods entries in UPPERCASE — matching is case-sensitive","Include OPTIONS whenever the API is called cross-origin","Revisit the list each time you add an endpoint with a new HTTP verb"],"tags":["sa-token","firewall","security","http-method"],"backgroundTag":null,"analyzedSha":"ac2c7f6e94a78573cf0bcb932dd8b04e68fad189","analyzedAt":"2026-08-14T14:36:10.271Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}