ruby/rubygems · error · Gem::WebauthnVerificationError

Security device verification failed: Invalid HTTP method #{m

Error message

Security device verification failed: Invalid HTTP method #{method.upcase} received.

What it means

Error "Security device verification failed: Invalid HTTP method #{method.upcase} received." thrown in ruby/rubygems.

Source

Thrown at lib/rubygems/gemcutter_utilities/webauthn_listener.rb:76

        unless root_path?(req_uri)
          responder.send(NotFoundResponse.for(host))
          raise Gem::WebauthnVerificationError, "Page at #{req_uri.path} not found."
        end

        case method.upcase
        when "OPTIONS"
          responder.send(NoContentResponse.for(host))
          next # will be GET
        when "GET"
          if otp = parse_otp_from_uri(req_uri)
            responder.send(OkResponse.for(host))
            return otp
          end
          responder.send(BadRequestResponse.for(host))
          raise Gem::WebauthnVerificationError, "Did not receive OTP from #{host}."
        else
          responder.send(MethodNotAllowedResponse.for(host))
          raise Gem::WebauthnVerificationError, "Invalid HTTP method #{method.upcase} received."
        end
      end
    end

    private

    def root_path?(uri)
      uri.path == "/"
    end

    def parse_otp_from_uri(uri)
      query = uri.query
      return unless query && !query.empty?

      query.split("&") do |param|
        key, value = param.split("=", 2)
        if value && Gem::URI.decode_www_form_component(key) == "code"
          return Gem::URI.decode_www_form_component(value)

View on GitHub (pinned to 86cbb817a3)

When it happens

Trigger: Thrown at lib/rubygems/gemcutter_utilities/webauthn_listener.rb:76 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruby/rubygems@86cbb817a3 (2026-08-23). Data as JSON: /api/errors/ebe91bbc5119d00a. Report an issue: GitHub.