phalcon/cphalcon · error · Phalcon\Http\Request\Exceptions\InvalidHttpMethod

Invalid HTTP method: non-string

Error message

Invalid HTTP method: non-string

What it means

Request::isMethod() with strict=true throws InvalidHttpMethod('non-string') when $methods is neither a string nor an array (null, int, object). The array branch recurses into isMethod($method, $strict) per element, so an array containing a non-string element throws the same error. Strict mode demands every method name be a string.

Source

Thrown at phalcon/Http/Request.zep:1265

            if unlikely (strict && !this->isValidHttpMethod(methods)) {
                throw new InvalidHttpMethod(methods);
            }

            return methods == httpMethod;
        }

        if typeof methods == "array" {
            for method in methods {
                if this->isMethod(method, strict) {
                    return true;
                }
            }

            return false;
        }

        if unlikely strict {
            throw new InvalidHttpMethod("non-string");
        }

        return false;
    }

    /**
     * Checks whether HTTP method is OPTIONS.
     * if _SERVER["REQUEST_METHOD"]==="OPTIONS"
     */
    public function isOptions() -> bool
    {
        return this->getMethod() === self::METHOD_OPTIONS;
    }

    /**
     * Checks whether HTTP method is PATCH.
     * if _SERVER["REQUEST_METHOD"]==="PATCH"
     */

View on GitHub (pinned to b7419de9cd)

Solutions

1. Guard the input: only call with is_string($methods) or a pure string array
2. Default the variable: $method = $request->getHeader('X-HTTP-Method') ?? $request->getMethod();
3. Drop strict mode (pass false) when the input cannot be trusted to be a valid verb name

Example fix

// before
$method = $request->getHeader('X-HTTP-Method'); // null when absent
$request->isMethod($method, true); // throws 'non-string'

// after
$method = $request->getHeader('X-HTTP-Method') ?? $request->getMethod();
$request->isMethod($method, true);

if (!is_string($methods) && !is_array($methods)) {
    $methods = $request->getMethod(); // sensible default when e.g. header absent
}
$request->isMethod($methods, true);

function isMethodNameList(mixed $methods): bool
{
    if (is_string($methods)) {
        return true;
    }
    return is_array($methods) && !in_array(false, array_map('is_string', $methods), true);
}

try { $request->isMethod($methods, true); } catch (\Phalcon\Http\Request\Exceptions\InvalidHttpMethod $e) { // 'non-string' means bad input -> client error
    http_response_code(400);
    exit('Invalid method parameter');
}

When it happens

Trigger: isMethod(null, true) - e.g. $method = $request->getHeader('X-HTTP-Method') when the header is absent; isMethod(123, true); isMethod(['GET', null], true) via the per-element recursion.

Common situations: Reading an optional override header that may be missing; passing unvalidated JSON/body values into isMethod; refactors that changed a variable from string to nullable.

Related errors

• Invalid HTTP method: {methods}
• Invalid host {host}
• A null key is not allowed; bag elements must be written with
• Response was already sent
• Non-standard status-code given without a message

AI-assisted analysis of phalcon/cphalcon@b7419de9cd (2026-08-21). Data as JSON: /api/errors/299982f5568a6c70. Report an issue: GitHub.