{"record":{"id":"e872b417471e1b49","repo":"vllm-project/vllm","slug":"invalid-allowed-methods-value-method-e","errorCode":null,"errorMessage":"invalid --allowed-methods value {method:?}: {e}","messagePattern":"invalid --allowed-methods value (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"rust/src/server/src/config.rs","lineNumber":95,"sourceCode":"        }\n    }\n}\n\nimpl CorsConfig {\n    /// Validate that non-wildcard values parse into HTTP types, so the CORS\n    /// layer can be built infallibly after startup validation has run.\n    pub fn validate(&self) -> Result<()> {\n        for origin in &self.allow_origins {\n            if origin != \"*\" {\n                origin.parse::<HeaderValue>().map_err(|e| {\n                    anyhow::anyhow!(\"invalid --allowed-origins value {origin:?}: {e}\")\n                })?;\n            }\n        }\n        for method in &self.allow_methods {\n            if method != \"*\" {\n                method.parse::<Method>().map_err(|e| {\n                    anyhow::anyhow!(\"invalid --allowed-methods value {method:?}: {e}\")\n                })?;\n            }\n        }\n        for header in &self.allow_headers {\n            if header != \"*\" {\n                header.parse::<HeaderName>().map_err(|e| {\n                    anyhow::anyhow!(\"invalid --allowed-headers value {header:?}: {e}\")\n                })?;\n            }\n        }\n        Ok(())\n    }\n}\n\n/// TLS settings mirroring Python's uvicorn `ssl_*` arguments.\n#[derive(Debug, Clone, PartialEq, Eq, Serialize)]\npub struct TlsConfig {\n    /// PEM certificate chain file. Required when TLS is configured; may also","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/vllm-project/vllm/blob/c794754062d49a8fdb63ab3c5215b488b865030c/rust/src/server/src/config.rs#L77-L113","documentation":"Thrown by CorsConfig::validate() in the Rust server's startup validation when a --allowed-methods entry (other than \"*\") fails to parse as an http::Method. The server pre-validates CORS entries so the tower CORS layer can be built infallibly afterwards. The offending value and the underlying parse error are included in the message.","triggerScenarios":"Passing --allowed-methods with a value that is not a valid HTTP method token, e.g. --allowed-methods 'GET,fetch' or --allowed-methods 'GET;' (delimiters or lowercase-with-typos like 'post ' with whitespace). Validation runs at server startup before any listener is bound; the first bad entry aborts boot.","commonSituations":"Copy-pasting a CORS methods list from a browser fetch preflight example (which may include custom verbs or commas), quoting the whole list as one token ('GET,POST' without splitting), or trailing whitespace/newlines in a env-derived list.","solutions":["Use standard HTTP method names only: --allowed-methods GET --allowed-methods POST (repeat the flag per method) or a properly split list.","Use \"*\" to allow all methods.","Trim whitespace and remove delimiters from each entry before passing them.","Check the {method:?} value in the message to see exactly which entry failed to parse."],"exampleFix":"# before\n--allowed-methods 'GET, POST,fetch'\n\n# after\n--allowed-methods GET --allowed-methods POST --allowed-methods FETCH  # note: FETCH is invalid; use real verbs\n# or simply allow all:\n--allowed-methods '*'","handlingStrategy":"validation","validationCode":"fn valid_methods(methods: &[String]) -> bool {\n    methods.iter().all(|m| m == \"*\" || m.parse::<http::Method>().is_ok())\n}\n// before building Config:\nassert!(valid_methods(&cfg.allow_methods), \"bad --allowed-methods entry\");","typeGuard":"fn is_valid_method_list(methods: &[String]) -> bool {\n    methods.iter().all(|m| m == \"*\" || m.parse::<http::Method>().is_ok())\n}","tryCatchPattern":null,"preventionTips":["Emit each method as its own flag value instead of one comma-joined string.","Trim whitespace from every entry before validation.","Add a startup config lint step in CI that runs Config::validate() on the rendered args."],"tags":["configuration","cors","http","rust","vllm","startup"],"backgroundTag":null,"analyzedSha":"c794754062d49a8fdb63ab3c5215b488b865030c","analyzedAt":"2026-08-14T21:17:39.825Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}