wavetermdev/waveterm · warning
Method not allowed
Error message
Method not allowed
What it means
WaveAIPostMessageHandler only accepts POST requests. Any other HTTP method (GET, PUT, DELETE, etc.) is rejected with 405 Method Not Allowed and this body text. This is standard HTTP method gating for an endpoint that writes a message into a chat.
Source
Thrown at pkg/aiusechat/usechat.go:638
})
_ = telemetry.RecordTEvent(ctx, event)
}
// PostMessageRequest represents the request body for posting a message
type PostMessageRequest struct {
TabId string `json:"tabid,omitempty"`
BuilderId string `json:"builderid,omitempty"`
BuilderAppId string `json:"builderappid,omitempty"`
ChatID string `json:"chatid"`
Msg uctypes.AIMessage `json:"msg"`
WidgetAccess bool `json:"widgetaccess,omitempty"`
AIMode string `json:"aimode"`
}
func WaveAIPostMessageHandler(w http.ResponseWriter, r *http.Request) {
// Only allow POST method
if r.Method != http.MethodPost {
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
return
}
// Parse request body
var req PostMessageRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
http.Error(w, fmt.Sprintf("Invalid request body: %v", err), http.StatusBadRequest)
return
}
// Validate chatid is present and is a UUID
if req.ChatID == "" {
http.Error(w, "chatid is required in request body", http.StatusBadRequest)
return
}
if _, err := uuid.Parse(req.ChatID); err != nil {
http.Error(w, "chatid must be a valid UUID", http.StatusBadRequest)
returnView on GitHub (pinned to a4447c1563)
Solutions
- Send the request with method POST: fetch(url, {method: 'POST', ...}) or curl -X POST.
- Include a JSON body with the required fields (chatid, message, aimode) since POST proceeds to body parsing next.
- If a probe/health-check is hitting this route, point it at a dedicated GET endpoint.
Example fix
// before
fetch("/api/aiusechat/message") // GET -> 405
// after
fetch("/api/aiusechat/message", {
method: "POST",
headers: {"Content-Type": "application/json"},
body: JSON.stringify({chatid: id, message: "hi"})
}) Defensive patterns
Strategy: validation
Validate before calling
if (method.toUpperCase() !== 'POST') throw new Error('endpoint requires POST'); Try / catch
const res = await fetch(url, { method: "POST", headers: {"Content-Type": "application/json"}, body });
if (res.status === 405) {
throw new Error("wrong HTTP method for this endpoint; use POST");
} Prevention
- Always specify method: 'POST' explicitly in fetch/axios calls
- Don't open write endpoints directly in a browser (issues GET)
- Exclude write routes from GET-based health checks and crawlers
When it happens
Trigger: Sending GET/PUT/DELETE (or opening the URL in a browser, which issues GET) to the route registered to WaveAIPostMessageHandler; an HTTP client or redirect following that downgrades to GET.
Common situations: Testing the endpoint in a browser address bar; a fetch/axios call defaulting to GET; reverse-proxy or health-check probes hitting the route with GET.
Related errors
- Invalid request body: %v
- method not allowed
- missing zone file info for ${zoneId}:${fileName}
- call ${methodName} failed: ${resp.status} ${resp.statusText}
- Failed to fetch config: ${configResponse.statusText}
AI-assisted analysis of wavetermdev/waveterm@a4447c1563 (2026-09-01).
Data as JSON: /api/errors/826bb21e212eceb5.
Report an issue: GitHub.