phalcon/cphalcon · error · Phalcon\Http\Request\Exceptions\InvalidHttpMethod

Invalid HTTP method: {methods}

Error message

Invalid HTTP method: {methods}

What it means

Request::isMethod($methods, $strict = true) validates string method names via isValidHttpMethod(), which accepts the known verbs (GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD, TRACE, CONNECT, PURGE). In strict mode an unrecognized verb throws InvalidHttpMethod instead of quietly returning false.

Source

Thrown at phalcon/Http/Request.zep:1248

    }

    /**
     * Check if HTTP method match any of the passed methods
     * When strict is true it checks if validated methods are real HTTP methods
     *
     * @todo check the $methods type - refactor this !!
     *
     * @param mixed $methods
     */
    public function isMethod(var methods, bool strict = false) -> bool
    {
        var httpMethod, method;

        let httpMethod = this->getMethod();

        if typeof methods == "string" {
            if unlikely (strict && !this->isValidHttpMethod(methods)) {
                throw new InvalidHttpMethod(methods);
            }

            return methods == httpMethod;
        }

        if typeof methods == "array" {
            for method in methods {
                if this->isMethod(method, strict) {
                    return true;
                }
            }

            return false;
        }

        if unlikely strict {
            throw new InvalidHttpMethod("non-string");
        }

View on GitHub (pinned to b7419de9cd)

Solutions

1. Pass only recognized verbs, upper-cased: GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD, TRACE, CONNECT, PURGE
2. Call isMethod($method) without strict (default false) when only a boolean comparison is wanted
3. Pre-validate with $request->isValidHttpMethod($method) and reject unknown verbs before the strict call

Example fix

// before
if ($request->isMethod($overrideHeader, true)) { ... } // throws on 'PROPFIND'

// after
$method = strtoupper((string) $overrideHeader);
if ($request->isValidHttpMethod($method) && $request->isMethod($method, true)) {
    // known verb only
}

$method = strtoupper((string) $method);
if (!$request->isValidHttpMethod($method)) {
    throw new \InvalidArgumentException('Unsupported HTTP verb: ' . $method);
}
return $request->isMethod($method, true);

function isKnownHttpMethod(mixed $method): bool
{
    return is_string($method)
        && in_array(strtoupper($method), ['GET','POST','PUT','DELETE','PATCH','OPTIONS','HEAD','TRACE','CONNECT','PURGE'], true);
}

try { $ok = $request->isMethod($verb, true); } catch (\Phalcon\Http\Request\Exceptions\InvalidHttpMethod $e) { http_response_code(405); exit('Method Not Allowed'); }

When it happens

Trigger: $request->isMethod('PROPFIND', true); isMethod('FOO', true); any string outside the supported verb list with the second argument true.

Common situations: WebDAV/CalDAV verbs (PROPFIND, REPORT) reaching strict routes; X-HTTP-Method-Override headers carrying arbitrary values; security-hardened code that turned strict mode on while the app legitimately sees unusual methods.

Related errors

• Invalid host {host}
• Invalid HTTP method: non-string
• Unable to insert into {table} without data
• The number of values in the update is not the same as fields
• Response was already sent

AI-assisted analysis of phalcon/cphalcon@b7419de9cd (2026-08-21). Data as JSON: /api/errors/c607d3c4c274bf54. Report an issue: GitHub.