{"record":{"id":"e89cc4cabe3887e4","repo":"remix-run/remix","slug":"invalid-bypass-pattern-json-stringify-pattern","errorCode":null,"errorMessage":"invalid bypass pattern ${JSON.stringify(pattern)}: path must start with \"/\"","messagePattern":"invalid bypass pattern (.+?): path must start with \"/\"","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/cop-middleware/src/lib/cop.ts","lineNumber":245,"sourceCode":"    throw new Error('bypass pattern must not be empty')\n  }\n\n  let method: RequestMethod | null = null\n  let pathname = trimmedPattern\n  let methodPattern = /^([A-Z]+)\\s+(.+)$/.exec(trimmedPattern)\n\n  if (methodPattern != null && methodPattern[2].startsWith('/')) {\n    let maybeMethod = methodPattern[1]\n    if (!isRequestMethod(maybeMethod)) {\n      throw new Error(`invalid request method in bypass pattern ${JSON.stringify(pattern)}`)\n    }\n\n    method = maybeMethod\n    pathname = methodPattern[2]\n  }\n\n  if (!pathname.startsWith('/')) {\n    throw new Error(`invalid bypass pattern ${JSON.stringify(pattern)}: path must start with \"/\"`)\n  }\n\n  if (pathname.includes('?') || pathname.includes('#')) {\n    throw new Error(\n      `invalid bypass pattern ${JSON.stringify(pattern)}: query strings and fragments are not supported`,\n    )\n  }\n\n  let matchesSubtree = pathname.endsWith('/')\n  let normalizedPathname =\n    pathname.length > 1 && matchesSubtree ? pathname.slice(0, pathname.length - 1) : pathname\n  let rawSegments = normalizedPathname === '/' ? [] : normalizedPathname.slice(1).split('/')\n  let segments = rawSegments.map((segment, index) =>\n    parseBypassSegment(pattern, segment, index === rawSegments.length - 1),\n  )\n\n  return { method, pathname, segments, matchesSubtree }\n}","sourceCodeStart":227,"sourceCodeEnd":263,"githubUrl":"https://github.com/remix-run/remix/blob/9696913134be3a4423513d2775f7b31d6917c049/packages/cop-middleware/src/lib/cop.ts#L227-L263","documentation":"This error is thrown by parseBypassPattern when a path portion of a bypass pattern passed to addInsecureBypassPattern does not begin with '/'. The cop-middleware matches request pathnames against registered bypass patterns, and a leading slash is required so patterns align with URL pathname semantics. Any pattern whose path segment lacks the leading slash is rejected immediately at registration time.","triggerScenarios":"Calling addInsecureBypassPattern('GET admin/*') or addInsecureBypassPattern({ method: 'POST', path: 'api/public' }) — any pattern whose path part does not start with '/'. Also occurs when a pattern string like 'GET /admin' is mis-parsed so the method consumes the slash, or the path is an empty string.","commonSituations":"Copy-pasting route paths from a router config that omits leading slashes; passing a Windows-style or relative path; forgetting the slash after an HTTP method prefix ('GET admin' instead of 'GET /admin').","solutions":["Add a leading '/' to the path: addInsecureBypassPattern('GET /admin') instead of 'GET admin'","If using a method prefix, verify the format is 'METHOD /path' with the slash present","Double-check programmatically generated patterns prepend '/' before registration"],"exampleFix":"// before\ncop.addInsecureBypassPattern('GET admin/*')\n// after\ncop.addInsecureBypassPattern('GET /admin/*')","handlingStrategy":"validation","validationCode":"function assertBypassPath(pattern: string) {\n  const path = pattern.includes(' ') ? pattern.slice(pattern.indexOf(' ') + 1) : pattern\n  if (!path.startsWith('/')) throw new Error(`pattern path must start with '/': ${pattern}`)\n}\nassertBypassPath('GET /admin')","typeGuard":"function hasValidBypassPath(pattern: string): boolean {\n  const path = pattern.includes(' ') ? pattern.slice(pattern.indexOf(' ') + 1).trim() : pattern\n  return path.startsWith('/')\n}","tryCatchPattern":"try { cop.addInsecureBypassPattern(p) } catch (e) { if (e instanceof Error && e.message.includes('path must start with')) { /* log config error, fix pattern */ } throw e }","preventionTips":["Centralize bypass patterns in one config module with tests","Write a startup validator that checks every pattern's path prefix before registration"],"tags":["cop-middleware","bypass-pattern","validation","configuration"],"backgroundTag":"invalid-path-pattern","analyzedSha":"9696913134be3a4423513d2775f7b31d6917c049","analyzedAt":"2026-08-27T19:55:01.024Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}