{"record":{"id":"f4c5e69dcbd1a15e","repo":"spring-projects/spring-security","slug":"method-is-invalid","errorCode":null,"errorMessage":"method is invalid","messagePattern":"method is invalid","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/DPoPProofContext.java","lineNumber":167,"sourceCode":"\t\t\treturn this;\n\t\t}\n\n\t\t/**\n\t\t * Builds a new {@link DPoPProofContext}.\n\t\t * @return a {@link DPoPProofContext}\n\t\t */\n\t\tpublic DPoPProofContext build() {\n\t\t\tAssert.hasText(this.method, \"method cannot be empty\");\n\t\t\tAssert.hasText(this.targetUri, \"targetUri cannot be empty\");\n\t\t\tvalidate();\n\t\t\treturn new DPoPProofContext(this.dPoPProof, this.method, this.targetUri, this.accessToken);\n\t\t}\n\n\t\tprivate void validate() {\n\t\t\tif (!\"GET\".equals(this.method) && !\"HEAD\".equals(this.method) && !\"POST\".equals(this.method)\n\t\t\t\t\t&& !\"PUT\".equals(this.method) && !\"PATCH\".equals(this.method) && !\"DELETE\".equals(this.method)\n\t\t\t\t\t&& !\"OPTIONS\".equals(this.method) && !\"TRACE\".equals(this.method)) {\n\t\t\t\tthrow new IllegalArgumentException(\"method is invalid\");\n\t\t\t}\n\t\t\tURI uri;\n\t\t\ttry {\n\t\t\t\turi = new URI(this.targetUri);\n\t\t\t\turi.toURL();\n\t\t\t}\n\t\t\tcatch (Exception ex) {\n\t\t\t\tthrow new IllegalArgumentException(\"targetUri must be a valid URL\", ex);\n\t\t\t}\n\t\t\tif (uri.getQuery() != null || uri.getFragment() != null) {\n\t\t\t\tthrow new IllegalArgumentException(\"targetUri cannot contain query or fragment parts\");\n\t\t\t}\n\t\t}\n\n\t}\n\n}\n","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/DPoPProofContext.java#L149-L185","documentation":"DPoPProofContext.validate enforces that the HTTP method used to build a DPoP proof is one of the standard HTTP methods (GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS, TRACE). An IllegalArgumentException is thrown for anything else, since RFC 9449 DPoP proofs only make sense for known HTTP methods. This runs when constructing a DPoP proof JWT context.","triggerScenarios":"Creating a DPoPProofContext (via DPoPProofOptions/DPoPProofService) with a method value that is null, empty, lowercase (\"get\"), or a non-standard method (e.g. \"CUSTOM\").","commonSituations":"Passing the HTTP method from a framework that returns it in a different case, a custom REST method, or forgetting to normalize user/config-supplied input before building the proof.","solutions":["Normalize the method to uppercase before building the context: method.toUpperCase(Locale.ROOT).","Use only standard HTTP methods defined in the RFC7231 set.","Validate the method against an allow-list before calling the DPoP proof service.","Catch IllegalArgumentException around DPoP proof creation and surface a config error."],"exampleFix":"// before\nDPoPProofContext ctx = new DPoPProofContext(\"get\", uri, ...); // throws\n// after\nDPoPProofContext ctx = new DPoPProofContext(\"get\".toUpperCase(Locale.ROOT), uri, ...);","handlingStrategy":"validation","validationCode":"List.of(\"GET\",\"HEAD\",\"POST\",\"PUT\",\"PATCH\",\"DELETE\",\"OPTIONS\",\"TRACE\").contains(method.toUpperCase(Locale.ROOT));","typeGuard":"boolean isValidHttpMethod(String m) {\n    return m != null && Set.of(\"GET\",\"HEAD\",\"POST\",\"PUT\",\"PATCH\",\"DELETE\",\"OPTIONS\",\"TRACE\")\n        .contains(m.toUpperCase(Locale.ROOT));\n}","tryCatchPattern":null,"preventionTips":["Normalize HTTP methods with toUpperCase(Locale.ROOT) before building DPoP contexts.","Use HttpMethod constants from Spring instead of raw strings.","Reject unknown methods at your API boundary."],"tags":["dpop","http","validation","oauth2","spring-security"],"backgroundTag":"invalid-enum-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}