{"record":{"id":"e495c1e582a16a1b","repo":"seanmonstar/warp","slug":"illegal-method","errorCode":null,"errorMessage":"illegal Method","messagePattern":"illegal Method","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/filters/cors.rs","lineNumber":91,"sourceCode":"impl Builder {\n    /// Sets whether to add the `Access-Control-Allow-Credentials` header.\n    pub fn allow_credentials(mut self, allow: bool) -> Self {\n        self.credentials = allow;\n        self\n    }\n\n    /// Adds a method to the existing list of allowed request methods.\n    ///\n    /// # Panics\n    ///\n    /// Panics if the provided argument is not a valid `http::Method`.\n    pub fn allow_method<M>(mut self, method: M) -> Self\n    where\n        http::Method: TryFrom<M>,\n    {\n        let method = match TryFrom::try_from(method) {\n            Ok(m) => m,\n            Err(_) => panic!(\"illegal Method\"),\n        };\n        self.methods.insert(method);\n        self\n    }\n\n    /// Adds multiple methods to the existing list of allowed request methods.\n    ///\n    /// # Panics\n    ///\n    /// Panics if the provided argument is not a valid `http::Method`.\n    pub fn allow_methods<I>(mut self, methods: I) -> Self\n    where\n        I: IntoIterator,\n        http::Method: TryFrom<I::Item>,\n    {\n        let iter = methods.into_iter().map(|m| match TryFrom::try_from(m) {\n            Ok(m) => m,\n            Err(_) => panic!(\"illegal Method\"),","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/seanmonstar/warp/blob/ff34d7213ed55ec342304aa7ff6ac4b351da9e66/src/filters/cors.rs#L73-L109","documentation":"The `allow_method` builder on the CORS filter converts the given value into `http::Method`; if the conversion fails (e.g. an invalid method string), the library panics with \"illegal Method\" because the CORS builder API is meant to be configured with statically valid methods at startup.","triggerScenarios":"Calling `warp::cors().allow_method(m)` where `m` cannot be converted to `http::Method` — most commonly a `&str` that is not a valid HTTP method token (e.g. `allow_method(\"GET-POST\")`, empty string, or a string with illegal characters).","commonSituations":"Reading allowed methods from config/env where values are typos or contain whitespace, dynamically building method lists from user input, version changes in method parsing rules, passing lowercase or malformed tokens.","solutions":["Validate the method string before passing it: it must be a valid HTTP token (e.g. \"GET\", \"POST\", \"PUT\", \"DELETE\", \"PATCH\", \"HEAD\", \"OPTIONS\").","Use `http::Method::try_from(s)` yourself first, or pass `http::Method` constants directly (`http::Method::GET`) to guarantee success.","If methods come from config, filter/validate the list at load time and fail fast with a clear config error instead of a panic in the builder.","Fix typos or stray whitespace/uppercase issues in the configured method names."],"exampleFix":"// before\nlet cors = warp::cors().allow_method(cfg.method_str); // panics if invalid\n\n// after\nlet method: http::Method = cfg\n    .method_str\n    .parse()\n    .expect(\"CORS method must be a valid HTTP method like GET or POST\");\nlet cors = warp::cors().allow_method(method);","handlingStrategy":"validation","validationCode":"fn is_valid_method(s: &str) -> bool {\n    http::Method::try_from(s).is_ok()\n}\n// before calling: assert!(is_valid_method(cfg.method_str));","typeGuard":"fn as_method(s: &str) -> Option<http::Method> {\n    http::Method::try_from(s).ok()\n}","tryCatchPattern":"// panic-based API; validate instead of catching:\nlet m = http::Method::try_from(input)\n    .map_err(|e| format!(\"invalid CORS method '{}': {}\", input, e))?;\nlet cors = warp::cors().allow_method(m);","preventionTips":["Prefer `http::Method::GET`-style constants over raw strings.","Validate config-sourced methods at startup with try_from.","Trim and uppercase strings read from env/config before use.","Never pass user-supplied input directly into CORS builders."],"tags":["cors","panic","invalid-argument","http-method","configuration"],"backgroundTag":"invalid-argument-value","analyzedSha":"ff34d7213ed55ec342304aa7ff6ac4b351da9e66","analyzedAt":"2026-09-09T16:57:46.316Z","contentChangedAt":"2026-09-09T16:57:46.316Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}