remix-run/remix · error · Error

invalid bypass pattern ${JSON.stringify(pattern)}: query str

Error message

invalid bypass pattern ${JSON.stringify(pattern)}: query strings and fragments are not supported

What it means

parseBypassPattern rejects bypass patterns whose path contains '?' or '#'. Bypass matching operates on the pathname only; query strings and fragments are deliberately unsupported because bypass decisions should not depend on those URL components. Including them is treated as a configuration mistake.

Source

Thrown at packages/cop-middleware/src/lib/cop.ts:249

  let pathname = trimmedPattern
  let methodPattern = /^([A-Z]+)\s+(.+)$/.exec(trimmedPattern)

  if (methodPattern != null && methodPattern[2].startsWith('/')) {
    let maybeMethod = methodPattern[1]
    if (!isRequestMethod(maybeMethod)) {
      throw new Error(`invalid request method in bypass pattern ${JSON.stringify(pattern)}`)
    }

    method = maybeMethod
    pathname = methodPattern[2]
  }

  if (!pathname.startsWith('/')) {
    throw new Error(`invalid bypass pattern ${JSON.stringify(pattern)}: path must start with "/"`)
  }

  if (pathname.includes('?') || pathname.includes('#')) {
    throw new Error(
      `invalid bypass pattern ${JSON.stringify(pattern)}: query strings and fragments are not supported`,
    )
  }

  let matchesSubtree = pathname.endsWith('/')
  let normalizedPathname =
    pathname.length > 1 && matchesSubtree ? pathname.slice(0, pathname.length - 1) : pathname
  let rawSegments = normalizedPathname === '/' ? [] : normalizedPathname.slice(1).split('/')
  let segments = rawSegments.map((segment, index) =>
    parseBypassSegment(pattern, segment, index === rawSegments.length - 1),
  )

  return { method, pathname, segments, matchesSubtree }
}

function parseBypassSegment(
  pattern: string,
  segment: string,

View on GitHub (pinned to 9696913134)

Solutions

1. Strip the query string and fragment from the pattern: use '/search' instead of '/search?q=1'
2. If you need query-dependent behavior, implement it in middleware logic inspecting URLSearchParams, not in the bypass pattern

Example fix

// before
cop.addInsecureBypassPattern('/search?q=1')
// after
cop.addInsecureBypassPattern('/search')

function isValidBypassPath(pattern: string): boolean {
  const path = pattern.includes(' ') ? pattern.slice(pattern.indexOf(' ') + 1) : pattern
  return !path.includes('?') && !path.includes('#')
}

const isQueryFree = (p: string) => !/[?#]/.test(p)

try { cop.addInsecureBypassPattern(p) } catch (e) { if (e instanceof Error && e.message.includes('query strings and fragments')) { p = p.split(/[?#]/)[0] } else throw e }

When it happens

Trigger: addInsecureBypassPattern('/search?q=1'), addInsecureBypassPattern('/products#details'), or any pattern where the path portion contains a '?' or '#' character anywhere.

Common situations: Copying a full URL with query parameters from a browser into a bypass list; attempting to bypass only requests carrying a specific query parameter; pasting a route that includes a hash anchor.

Related errors

• invalid bypass pattern ${JSON.stringify(pattern)}: path must
• invalid bypass pattern ${JSON.stringify(pattern)}: empty pat
• invalid bypass pattern ${JSON.stringify(pattern)}: empty wil
• invalid bypass pattern ${JSON.stringify(pattern)}: tail wild
• invalid bypass pattern ${JSON.stringify(pattern)}: tail wild

AI-assisted analysis of remix-run/remix@9696913134 (2026-08-27). Data as JSON: /api/errors/222f0482a9641591. Report an issue: GitHub.