theonedev/onedev · error · ClientException

Method not allowed

Error message

Method not allowed

What it means

Thrown at the end of HelmPackHandler.handle when the HTTP method is neither POST nor PUT (and not a handled read path), producing 405 Method Not Allowed. The Helm endpoint only supports upload (publish) and the handled GET/read operations; anything else is rejected.

Source

Thrown at server-plugin/server-plugin-pack-helm/src/main/java/io/onedev/server/plugin/pack/helm/HelmPackHandler.java:245

                    pack = new Pack();
                    pack.setProject(project);
                    pack.setType(HelmPackSupport.TYPE);
                    pack.setName(chartName);
                    pack.setVersion(chartVersion);
                }
                pack.setData(data);
                Build build = null;
                if (buildId != null)
                    build = buildService.load(buildId);
                pack.setBuild(build);
                pack.setUser(SecurityUtils.getUser());
                pack.setPublishDate(new Date());

                packService.createOrUpdate(pack, List.of(packBlob), true);
                response.setStatus(SC_CREATED);
            }));
        } else {
            throw new ClientException(SC_METHOD_NOT_ALLOWED, "Method not allowed");
        }
    }

    @Override
    public String getApiKey(HttpServletRequest request) {
        return null;
    }

	private Project checkProject(Long projectId, boolean needsToWrite) {
		var project = projectService.load(projectId);
		if (!project.isPackManagement()) {
			throw new ClientException(SC_NOT_ACCEPTABLE, "Package management not enabled for project '" + project.getPath() + "'");
		} else if (needsToWrite && !SecurityUtils.canWritePack(project)) {
			throw new UnauthorizedException("No package write permission for project: " + project.getPath());
		} else if (!needsToWrite && !SecurityUtils.canReadPack(project)) {
			throw new UnauthorizedException("No package read permission for project: " + project.getPath());
		}
		return project;

View on GitHub (pinned to d44925c47c)

Solutions

1. Use POST or PUT to publish charts to /~helm; use GET to download
2. Remove any DELETE/PATCH calls against the Helm pack endpoint — deletion is not supported via this handler
3. If a preflight/OPTIONS request triggers this, exempt the endpoint from preflight handling or use a client that avoids it
4. Check the CI script/curl -X flag for the wrong method

Example fix

// before
curl -X DELETE https://server/project/~helm/mychart-1.0.0.tgz
// after
curl -T mychart-1.0.0.tgz https://server/project/~helm

Set<String> allowed = Set.of("POST", "PUT", "GET", "HEAD");
if (!allowed.contains(httpMethod)) throw new IllegalArgumentException("unsupported method for helm pack endpoint: " + httpMethod);

try { publishChart(); } catch (ClientException e) { if (e.getMessage().equals("Method not allowed")) switchToPostUpload(); }

When it happens

Trigger: Sending DELETE, PATCH, or other unsupported verbs to the /~helm endpoint URL; misconfigured Helm publish scripts using the wrong HTTP method; health-check bots issuing OPTIONS.

Common situations: CI scripts calling the pack endpoint with DELETE to 'remove' a chart version (not supported), reverse-proxies forwarding OPTIONS preflights, or typos where GET was intended but an unexpected method string reaches the handler.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• 405
• Unauthenticated
• Http request failed (url: %s, status code: %d, error message
• Http request failed (status: %s)
• Method Not Allowed

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/33d46f4d36bf759a. Report an issue: GitHub.