[PR #1048] [MERGED] fix(server): reject invalid HTTP methods with 400 in app route handlers #1046

New issue

Closed

opened 2026-05-06 13:11:44 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:11:44 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/1048
Author: @NathanDrake2406
Created: 5/4/2026
Status: ✅ Merged
Merged: 5/4/2026
Merged by: @james-elicx

Base: main ← Head: fix/http-method-validation

📝 Commits (1)

82fa445 fix(server): reject invalid HTTP methods with 400 in app route handlers

📊 Changes

3 files changed (+74 additions, -1 deletions)

View changed files

📝 packages/vinext/src/server/app-route-handler-dispatch.ts (+12 -1)
📝 packages/vinext/src/server/app-route-handler-runtime.ts (+11 -0)
📝 tests/app-route-handler-dispatch.test.ts (+51 -0)

📄 Description

Summary

Vinext previously uppercased the request method and fell through to the normal 405 response for any unrecognized method. Next.js rejects non-standard methods with 400 Bad Request before dispatch.

Changes

Add isValidHTTPMethod() predicate to app-route-handler-runtime.ts, co-located with the existing ROUTE_HANDLER_HTTP_METHODS constant.
Return empty 400 in dispatchAppRouteHandler() before any auto-OPTIONS or 405 logic, matching Next.js behavior.
Port the Next.js test that verifies HEADER => 400.

Next.js source reference

Handler validation: packages/next/src/server/route-modules/app-route/module.ts#L390-L392
Test case: test/e2e/app-dir/app-routes/app-custom-routes.test.ts#L531-L538
HTTP method constants: packages/next/src/server/web/http.ts

Verification

vp test run tests/app-route-handler-dispatch.test.ts tests/app-route-handler-policy.test.ts tests/app-route-handler-runtime.test.ts — 25/25 passing
vp test run tests/app-router.test.ts -t "route handler" — 28/28 passing

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/1048 **Author:** [@NathanDrake2406](https://github.com/NathanDrake2406) **Created:** 5/4/2026 **Status:** ✅ Merged **Merged:** 5/4/2026 **Merged by:** [@james-elicx](https://github.com/james-elicx) **Base:** `main` ← **Head:** `fix/http-method-validation` --- ### 📝 Commits (1) - [`82fa445`](https://github.com/cloudflare/vinext/commit/82fa4458b3b74116f71ec8715fce72d573653e07) fix(server): reject invalid HTTP methods with 400 in app route handlers ### 📊 Changes **3 files changed** (+74 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/server/app-route-handler-dispatch.ts` (+12 -1) 📝 `packages/vinext/src/server/app-route-handler-runtime.ts` (+11 -0) 📝 `tests/app-route-handler-dispatch.test.ts` (+51 -0) </details> ### 📄 Description ## Summary Vinext previously uppercased the request method and fell through to the normal 405 response for any unrecognized method. Next.js rejects non-standard methods with **400 Bad Request** before dispatch. ## Changes - **Add `isValidHTTPMethod()` predicate** to `app-route-handler-runtime.ts`, co-located with the existing `ROUTE_HANDLER_HTTP_METHODS` constant. - **Return empty 400** in `dispatchAppRouteHandler()` before any auto-OPTIONS or 405 logic, matching Next.js behavior. - **Port the Next.js test** that verifies `HEADER` => 400. ## Next.js source reference - Handler validation: [`packages/next/src/server/route-modules/app-route/module.ts#L390-L392`](https://github.com/vercel/next.js/blob/canary/packages/next/src/server/route-modules/app-route/module.ts#L390-L392) - Test case: [`test/e2e/app-dir/app-routes/app-custom-routes.test.ts#L531-L538`](https://github.com/vercel/next.js/blob/canary/test/e2e/app-dir/app-routes/app-custom-routes.test.ts#L531-L538) - HTTP method constants: [`packages/next/src/server/web/http.ts`](https://github.com/vercel/next.js/blob/canary/packages/next/src/server/web/http.ts) ## Verification - `vp test run tests/app-route-handler-dispatch.test.ts tests/app-route-handler-policy.test.ts tests/app-route-handler-runtime.test.ts` — 25/25 passing - `vp test run tests/app-router.test.ts -t "route handler"` — 28/28 passing --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>