flarum/framework · error · BadRequestException

sort must be a string

Error message

sort must be a string

What it means

Validation-helper guard in RequestUtil::extractSort: the 'sort' query parameter, used by list endpoints to order results, must be a comma-separated string like '-createdAt,name'. If a client sends sort as an array (repeated ?sort[]= params) or any non-string value, it cannot be parsed, so a 400 BadRequestException is thrown.

Solutions

1. Send sort as a single string: ?sort=-createdAt
2. Do not use array params (?sort[]=...)
3. Fix the client serialization so sort is emitted once as a comma-separated list

When it happens

Trigger: Thrown at framework/core/src/Http/RequestUtil.php:123 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of flarum/framework@4b939f6853 (2026-09-15). Data as JSON: /api/errors/ceaade7d5e061d8a. Report an issue: GitHub.

Appendix: source

Thrown at framework/core/src/Http/RequestUtil.php:123

        $actorReference->setActor($actor);

        return $request;
    }

    public static function extractSort(Request $request, ?string $default, array $available = []): ?array
    {
        $input = $request->getQueryParams()['sort'] ?? null;

        if (is_null($input) || ! filled($input)) {
            $input = $default;
        }

        if (! $input) {
            return null;
        }

        if (! is_string($input)) {
            throw new BadRequestException('sort must be a string');
        }

        $sort = [];

        foreach (explode(',', $input) as $field) {
            if (str_starts_with($field, '-')) {
                $field = substr($field, 1);
                $order = 'desc';
            } else {
                $order = 'asc';
            }

            $sort[$field] = $order;
        }

        $invalid = array_diff(array_keys($sort), $available);

        if (count($invalid)) {

View on GitHub (pinned to 4b939f6853)