crowdsecurity/crowdsec · error

on_method_not_allowed: %w

Error message

on_method_not_allowed: %w

What it means

LoadSchema validates the OnMethodNotAllowed policy option, which must be exactly "drop" or "ignore". Any other value makes options.OnMethodNotAllowed.validate() fail, and the error is wrapped as "on_method_not_allowed: ...".

Source

Thrown at pkg/appsec/api_validation/api_validation.go:316

	}
}

func (rv *RequestValidator) LoadSchema(ref string, schema string, opts *SchemaOptions) error {
	if ref == "" {
		return errors.New("ref cannot be empty")
	}
	rv.logger.Debugf("loading schema for ref %s", ref)

	if _, exists := rv.loaders[ref]; exists {
		return fmt.Errorf("attempting to load a new schema for existing ref %s", ref)
	}

	options := opts.withDefaults()
	if err := options.OnRouteNotFound.validate(); err != nil {
		return fmt.Errorf("on_route_not_found: %w", err)
	}
	if err := options.OnMethodNotAllowed.validate(); err != nil {
		return fmt.Errorf("on_method_not_allowed: %w", err)
	}
	if err := options.OnUnsupportedSecurityScheme.validate(); err != nil {
		return fmt.Errorf("on_unsupported_security_scheme: %w", err)
	}

	loader := openapi3.NewLoader()
	rv.loaders[ref] = loader

	doc, err := loader.LoadFromData([]byte(schema))
	if err != nil {
		return fmt.Errorf("failed to load schema %s: %w", ref, err)
	}

	// Is it a valid OpenAPI schema?
	// TODO: look into opts, should we expose some of them to the user ?
	if err := doc.Validate(loader.Context, openapi3.DisableExamplesValidation()); err != nil {
		return fmt.Errorf("failed to validate schema %s: %w", ref, err)
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Set on_method_not_allowed to exactly "drop" or "ignore".
2. Fix casing/typos — values are lowercase and compared with string equality.
3. Omit the key in YAML (or leave the field unset) so the default is used.
4. Prefer the exported constants PolicyDrop/PolicyIgnore in Go code instead of raw strings.

Example fix

// before
opts.OnMethodNotAllowed = api_validation.Policy("")

// after
opts.OnMethodNotAllowed = api_validation.PolicyIgnore

if p := string(opts.OnMethodNotAllowed); p != "drop" && p != "ignore" {
    return fmt.Errorf("bad on_method_not_allowed: %q", p)
}

func isPolicy(s string) bool { return s == "drop" || s == "ignore" }

if err := rv.LoadSchema(ref, schema, opts); err != nil {
    if strings.Contains(err.Error(), "on_method_not_allowed:") {
        log.Errorf("fix on_method_not_allowed (drop|ignore): %v", err)
    }
    return err
}

When it happens

Trigger: Calling LoadSchema with SchemaOptions.OnMethodNotAllowed set to an invalid Policy string (typo, empty string, wrong case), usually from a misconfigured on_method_not_allowed key in the appsec YAML.

Common situations: Hand-edited config with a typo; copying policy values from documentation of another product; partially-filled SchemaOptions structs where an empty string was explicitly assigned instead of left unset.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• on_route_not_found: %w
• on_unsupported_security_scheme: %w
• missing lapi client credentials
• no appsec_config provided
• missing TLS key file

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/95f51df82844ac6d. Report an issue: GitHub.