remix-run/remix · error · Error

invalid request method in bypass pattern ${JSON.stringify(pa

Error message

invalid request method in bypass pattern ${JSON.stringify(pattern)}

What it means

A bypass pattern may start with an uppercase HTTP method ('GET /api'), but only recognized request methods are accepted. If the leading token looks like a method but isn't a valid one, this error is thrown.

Source

Thrown at packages/cop-middleware/src/lib/cop.ts:237

function serializeOrigin(origin: URL): string {
  return `${origin.protocol}//${origin.host}`
}

function parseBypassPattern(pattern: string): BypassPattern {
  let trimmedPattern = pattern.trim()
  if (trimmedPattern === '') {
    throw new Error('bypass pattern must not be empty')
  }

  let method: RequestMethod | null = null
  let pathname = trimmedPattern
  let methodPattern = /^([A-Z]+)\s+(.+)$/.exec(trimmedPattern)

  if (methodPattern != null && methodPattern[2].startsWith('/')) {
    let maybeMethod = methodPattern[1]
    if (!isRequestMethod(maybeMethod)) {
      throw new Error(`invalid request method in bypass pattern ${JSON.stringify(pattern)}`)
    }

    method = maybeMethod
    pathname = methodPattern[2]
  }

  if (!pathname.startsWith('/')) {
    throw new Error(`invalid bypass pattern ${JSON.stringify(pattern)}: path must start with "/"`)
  }

  if (pathname.includes('?') || pathname.includes('#')) {
    throw new Error(
      `invalid bypass pattern ${JSON.stringify(pattern)}: query strings and fragments are not supported`,
    )
  }

  let matchesSubtree = pathname.endsWith('/')
  let normalizedPathname =

View on GitHub (pinned to 9696913134)

Solutions

1. Use a standard method name in uppercase: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS
2. Omit the method entirely to match all methods for that path
3. Fix the typo (e.g. 'POST /api/x')

Example fix

// before
cop.addInsecureBypassPattern('FETCH /api/x')
// after
cop.addInsecureBypassPattern('GET /api/x')

const METHODS = ['GET','POST','PUT','PATCH','DELETE','HEAD','OPTIONS']
let m = /^([A-Z]+)\s+/.exec(pattern)
if (m && !METHODS.includes(m[1])) throw new Error('bad method in pattern')

function isValidPattern(p: string): boolean {
  let m = /^([A-Z]+)\s+(\/.+)$/.exec(p)
  return m == null || ['GET','POST','PUT','PATCH','DELETE','HEAD','OPTIONS'].includes(m[1])
}

When it happens

Trigger: addInsecureBypassPattern('FETCH /api/x'), 'get /api' (lowercase — note the regex requires uppercase, so lowercase 'get' is treated as a pathname instead and won't trigger this), or a path of uppercase words followed by a path, e.g. 'ADMIN /panel'.

Common situations: Typos in method names; assuming custom methods are allowed; using 'ALL' or '*' hoping to match any method.

Related errors

• trusted origin must not be empty
• invalid bypass pattern ${JSON.stringify(pattern)}: path must
• invalid bypass pattern ${JSON.stringify(pattern)}: query str
• invalid bypass pattern ${JSON.stringify(pattern)}: empty pat
• invalid bypass pattern ${JSON.stringify(pattern)}: empty wil

AI-assisted analysis of remix-run/remix@9696913134 (2026-08-27). Data as JSON: /api/errors/1bd563975d3de17f. Report an issue: GitHub.