What causes "failed to provide a valid HTTP method" in owasp-amass/amass?

Change the request Method to http.MethodGet, http.MethodPost, or http.MethodDelete (uppercase).

failed to provide a valid HTTP method

Error message

failed to provide a valid HTTP method

What it means

RequestWebPage in internal/net/http/http.go validates that the request struct's Method field is one of GET, POST, or DELETE before building the net/http request. If Method is set to any other value (or an invalid verb), the function refuses to proceed and returns this error instead of issuing an HTTP call. It exists to catch misuse of the Amass HTTP request wrapper early.

Source

Thrown at internal/net/http/http.go:179

		ProtoMajor: resp.ProtoMajor,
		ProtoMinor: resp.ProtoMinor,
		Header:     HdrToAmassHeader(resp.Header),
		Body:       body,
		Length:     int64(len(body)),
		TLS:        resp.TLS,
	}
}

// RequestWebPage returns the response headers, body, and status code for the provided URL when successful.
func RequestWebPage(ctx context.Context, client *http.Client, r *Request) (*Response, error) {
	if r == nil {
		return nil, errors.New("failed to provide a valid Amass HTTP request")
	}

	if r.Method == "" {
		r.Method = http.MethodGet
	} else if r.Method != http.MethodGet && r.Method != http.MethodPost && r.Method != http.MethodDelete {
		return nil, errors.New("failed to provide a valid HTTP method")
	}

	req, err := http.NewRequestWithContext(ctx, r.Method, r.URL, strings.NewReader(r.Body))
	if err != nil {
		return nil, err
	}
	req.Close = true

	if r.Auth != nil && r.Auth.Username != "" && r.Auth.Password != "" {
		req.SetBasicAuth(r.Auth.Username, r.Auth.Password)
	}

	req.Header.Set("User-Agent", UserAgent)
	req.Header.Set("Accept", Accept)
	req.Header.Set("Accept-Language", AcceptLang)
	for k, values := range r.Header {
		for _, v := range values {
			req.Header.Set(k, v)

View on GitHub (pinned to 79299dce87)

Solutions

Change the request Method to http.MethodGet, http.MethodPost, or http.MethodDelete (uppercase).
If the upstream API requires PUT/PATCH/HEAD, bypass the wrapper and use net/http directly.
Leave Method empty so the wrapper defaults it to GET.

Example fix

// before
req := &nethttp.Request{Method: "PUT", URL: u}
resp, err := nethttp.RequestWebPage(ctx, req)
// after
req := &nethttp.Request{Method: http.MethodPost, URL: u, Body: payload}
resp, err := nethttp.RequestWebPage(ctx, req)

Defensive patterns

Strategy: validation

Validate before calling

if m := req.Method; m != "" && m != http.MethodGet && m != http.MethodPost && m != http.MethodDelete {
    return fmt.Errorf("unsupported method %q: use GET, POST, or DELETE", m)
}

Prevention

Only assign http.Method* constants, never string literals.
Leave Method empty to get the GET default.
Centralize request construction in one helper that whitelists methods.

When it happens

Trigger: Setting Request.Method to a non-supported verb (e.g. PUT, PATCH, HEAD, TRACE, CONNECT) or a misspelled/lowercase method string before calling RequestWebPage.

Common situations: Porting code that used http.NewRequest with PUT/PATCH directly into the Amass wrapper; typos like "get" instead of "GET"; programmatically derived methods from config files that allow arbitrary verbs.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/b4b4d40b815fdb98. Report an issue: GitHub.