octobercms/october · error · Twig\Sandbox\SecurityNotAllowedMethodError

Calling "%s" method on a request is blocked in Safe Mode.

Error message

Calling "%s" method on a request is blocked in Safe Mode.

What it means

Error "Calling "%s" method on a request is blocked in Safe Mode." thrown in octobercms/october.

Source

Thrown at modules/system/twig/securitypolicy/SafeRequest.php:74

        // Locale
        'getLocale', 'getPreferredLanguage', 'getLanguages', 'getDefaultLocale',
    ];

    /**
     * __construct
     */
    public function __construct(Request $request)
    {
        $this->request = $request;
    }

    /**
     * __call magic
     */
    public function __call($method, $parameters)
    {
        if (!in_array($method, $this->allowedMethods, true)) {
            throw new SecurityNotAllowedMethodError(
                sprintf('Calling "%s" method on a request is blocked in Safe Mode.', $method),
                Request::class,
                $method
            );
        }

        return $this->request->{$method}(...$parameters);
    }

    /**
     * __get proxies property access. Twig may access common request fields
     * (e.g. {{ this.request.url }}) which Twig resolves via property access
     * before falling back to a method call. We only expose method-call
     * results, never the raw $server/$cookies/$headers bag properties.
     */
    public function __get($key)
    {
        if (in_array($key, $this->allowedMethods, true)) {

View on GitHub (pinned to b608633a7e)

When it happens

Trigger: Thrown at modules/system/twig/securitypolicy/SafeRequest.php:74 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of octobercms/october@b608633a7e (2026-08-21). Data as JSON: /api/errors/1edf5334d20d8f88. Report an issue: GitHub.