symfony/http-foundation · error · SuspiciousOperationException

Invalid HTTP method override.

Error message

Invalid HTTP method override.

What it means

When a method override header (X-HTTP-Method-Override) is present, Request::getMethod() accepts only uppercase A-Z strings. An override value containing anything else (lowercase letters, spaces, digits, symbols) throws SuspiciousOperationException('Invalid HTTP method override.') to block malformed or malicious override headers.

Solutions

1. Send the override value in uppercase: X-HTTP-Method-Override: PATCH.
2. Sanitize/normalize the header in middleware: strtoupper(trim($value)) before it reaches the request.
3. Ensure self::$allowedHttpMethodOverride only lists uppercase method names ('PUT','DELETE',...).
4. Catch SuspiciousOperationException and return 400 for bad override values.

Example fix

// before (client)
headers: { 'X-HTTP-Method-Override': 'delete' }

// after
headers: { 'X-HTTP-Method-Override': 'DELETE' }

$override = $request->headers->get('X-HTTP-Method-Override', '');
if ($override !== '' && !preg_match('/^[A-Z]+$/', $override)) {
    return new Response('Invalid HTTP method override', 400);
}

use Symfony\Component\HttpFoundation\Exception\SuspiciousOperationException;

try {
    $method = $request->getMethod();
} catch (SuspiciousOperationException $e) {
    return new Response('Invalid HTTP method override', 400);
}

When it happens

Trigger: Client sends header X-HTTP-Method-Override: 'patch' (lowercase), 'DELETE ', 'PUT;inject', or any value not strictly [A-Z]+; proxied requests where middleware adds a badly cased override header.

Common situations: JS clients or HTTP libraries setting the override header in lowercase; API gateways/interceptors normalizing methods incorrectly; security scans fuzzing the override header.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Invalid Host " ".
• Untrusted Host " ".
• Invalid URI: Userinfo is malformed.
• Invalid URI: A URI cannot contain a backslash.
• Invalid URI: A URI cannot contain CR/LF/TAB characters.

AI-assisted analysis of symfony/http-foundation@5aea19cd67 (2026-09-13). Data as JSON: /api/errors/b637dfe7b6596d91. Report an issue: GitHub.

Appendix: source

Thrown at Request.php:1302

            $method = $this->request->get('_method', $this->query->get('_method', 'POST'));
        }

        if (!\is_string($method)) {
            return $this->method;
        }

        $method = strtoupper($method);

        if (\in_array($method, ['GET', 'HEAD', 'CONNECT', 'TRACE'], true)) {
            return $this->method;
        }

        if (self::$allowedHttpMethodOverride && !\in_array($method, self::$allowedHttpMethodOverride, true)) {
            return $this->method;
        }

        if (\strlen($method) !== strspn($method, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ')) {
            throw new SuspiciousOperationException('Invalid HTTP method override.');
        }

        return $this->method = $method;
    }

    /**
     * Gets the "real" request method.
     *
     * @see getMethod()
     */
    public function getRealMethod(): string
    {
        return strtoupper($this->server->get('REQUEST_METHOD', 'GET'));
    }

    /**
     * Gets the mime type associated with the format.
     */

View on GitHub (pinned to 5aea19cd67)