dotnet/yarp · error · NotSupportedException

Unsupported request method '{method}'.

Error message

Unsupported request method '{method}'.

What it means

YARP's `GetHttpMethod` maps well-known HTTP method strings to `System.Net.Http.HttpMethod` instances. The CONNECT method is explicitly rejected with `NotSupportedException` because YARP does not support acting as a forward proxy for tunneling (CONNECT is used by clients to establish TLS tunnels through a proxy). This is distinct from the HTTP/2 extended CONNECT used internally for WebSocket proxying.

Source

Thrown at src/ReverseProxy/Forwarder/RequestUtilities.cs:50

    private static readonly SearchValues<char> s_validPathChars =
        SearchValues.Create("!$&'()*+,-./0123456789:;=@ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz~");

    /// <summary>
    /// Converts the given HTTP method (usually obtained from <see cref="HttpRequest.Method"/>)
    /// into the corresponding <see cref="HttpMethod"/> static instance.
    /// </summary>
    internal static HttpMethod GetHttpMethod(string method) => method switch
    {
        string mth when HttpMethods.IsGet(mth) => HttpMethod.Get,
        string mth when HttpMethods.IsPost(mth) => HttpMethod.Post,
        string mth when HttpMethods.IsPut(mth) => HttpMethod.Put,
        string mth when HttpMethods.IsDelete(mth) => HttpMethod.Delete,
        string mth when HttpMethods.IsOptions(mth) => HttpMethod.Options,
        string mth when HttpMethods.IsHead(mth) => HttpMethod.Head,
        string mth when HttpMethods.IsPatch(mth) => HttpMethod.Patch,
        string mth when HttpMethods.IsTrace(mth) => HttpMethod.Trace,
        // NOTE: Proxying "CONNECT" is not supported (by design!)
        string mth when HttpMethods.IsConnect(mth) => throw new NotSupportedException($"Unsupported request method '{method}'."),
        _ => new HttpMethod(method)
    };

    internal static bool ShouldSkipRequestHeader(string headerName)
    {
        if (_headersToExclude.Contains(headerName))
        {
            return true;
        }

        // Filter out HTTP/2 pseudo headers like ":method" and ":path", those go into other fields.
        if (headerName.StartsWith(':'))
        {
            return true;
        }

        return false;
    }

View on GitHub (pinned to bd11867bee)

Solutions

1. Do not configure clients to use YARP as a forward/CONNECT proxy. YARP is a reverse proxy only.
2. If you need CONNECT/forward-proxy behavior, use a dedicated forward proxy server (e.g., Squid, or ASP.NET Core's own forward proxy capabilities) instead of YARP.
3. Add middleware before YARP to intercept and reject CONNECT requests with a clear 405 Method Not Allowed response before they reach the forwarder.
4. Ensure your routing configuration does not accidentally match CONNECT requests — verify that no route pattern inadvertently catches tunneling attempts.

Example fix

// before — CONNECT reaches YARP and throws NotSupportedException
app.UseRouting();
app.UseEndpoints(endpoints => { endpoints.MapReverseProxy(); });
// after — reject CONNECT early with a clean 405
app.Use(async (context, next) =>
{
    if (HttpMethods.IsConnect(context.Request.Method))
    {
        context.Response.StatusCode = StatusCodes.Status405MethodNotAllowed;
        return;
    }
    await next();
});
app.UseRouting();
app.UseEndpoints(endpoints => { endpoints.MapReverseProxy(); });

// Reject CONNECT before it reaches YARP
if (HttpMethods.IsConnect(context.Request.Method))
{
    context.Response.StatusCode = StatusCodes.Status405MethodNotAllowed;
    return;
}

static bool IsConnectRequest(HttpContext context)
    => HttpMethods.IsConnect(context.Request.Method);

// NotSupportedException from GetHttpMethod is not recoverable for proxying.
// Prevent it by filtering CONNECT before the forwarder runs.

When it happens

Trigger: A client sends an HTTP request with method `CONNECT` (case-insensitive match via `HttpMethods.IsConnect`) to a route handled by YARP. The method dispatch in `GetHttpMethod` at line 50 hits the CONNECT case and throws. This occurs at `destinationRequest.Method = RequestUtilities.GetHttpMethod(context.Request.Method)` in the non-upgrade, non-connect code path (line 435).

Common situations: A browser or HTTP client is configured to use the YARP endpoint as an HTTP forward proxy and sends a CONNECT request to tunnel HTTPS. Or a test harness sends a raw CONNECT request to a reverse-proxied route. YARP is a reverse proxy, not a forward proxy, so CONNECT tunneling is not supported.

Related errors

• SPDY requests require HTTP/1.1 support, but outbound HTTP/1.
• An outgoing HTTP/1.1 Upgrade request is required to proxy th
• Replacing the YARP outgoing request HttpContent is not suppo
• The {typeof(IReverseProxyFeature).FullName} is missing the {
• {typeof(IReverseProxyFeature).FullName} is missing.

AI-assisted analysis of dotnet/yarp@bd11867bee (2026-08-13). Data as JSON: /api/errors/32512c980561e7c8. Report an issue: GitHub.