Expecting 405, getting routed to a param path instead

[bekabaz]

When I use regex with a path such as /users/{id:[0-9]+} this works really well to prevent static paths such as /users/me from being matched incorrectly. That is an issue of it's own really, and I was expecting go-chi to have better static matching than it does. Anyway, the regex on the path variable fixed that, however, it does not work when you have an additional subpath. For instance, when I create a route for /profiles/{id:[0-9]+}/usage this throws a 404 not found. The only way to make it work is to remove the regex, and then it's not the same style as the others where I must use {id:[0-9]+}

[VojtechVitek]

Hi, can you please send us a reproducer code or a test case? Expected vs. actual behavior?

[bekabaz]

@VojtechVitek sure can! I will illustrate both problems I mentioned above.

So with the first problem I mentioned about static routes not matching, here are registered routes I have for a users endpoint.

GET /users
POST /users
GET /users/me
GET /users/{id}
PUT /users/{id}
DELETE /users/{id}

When testing my API with Schemathesis, it tries to get a 405 Method Not Found by sending a PUT to /users/me, but instead of matching to the static path route defined as /users/me it actually matches to /users/{id} because that has a PUT available. The only way I found to "fix" this is to use a regex on the {id} path parameter, i.e. {id} -> {id:[0-9]+} This is an acceptable compromise to make this work correctly, however as soon as I introduce a second subpath past the id, it doesn't work with regex anymore. This feels inconsistent, and brittle as far as maintaining our server.

Sample Code with test lines defined in the comments

package main

import (
	"fmt"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
)

// To test, run main.go and send this request
// curl -i -X PUT "http://localhost:3000/users/me"
// Basic output is included to make debugging faster

func main() {
	r := chi.NewRouter()

	// Middleware
	r.Use(middleware.Logger)
	r.Use(middleware.Recoverer)

	// Routes
	r.Get("/users", func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	})

	r.Post("/users", func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	})

	r.Get("/users/me", func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	})

	r.Get("/users/{id}", func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	})

	r.Put("/users/{id}", func(w http.ResponseWriter, r *http.Request) {
		fmt.Println("error1")
		w.WriteHeader(http.StatusOK)
	})

	r.Delete("/users/{id}", func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	})

	err := chi.Walk(r, func(method string, route string, handler http.Handler, middlewares ...func(http.Handler) http.Handler) error {
		fmt.Printf("%s %s\n", method, route)
		return nil
	})
	if err != nil {
		fmt.Printf("Error walking routes: %v\n", err)
	}

	// Start server
	http.ListenAndServe(":3000", r)
}

The second issue involving regex is no longer an issue - I mislead myself into thinking it was chi, but it doesn't seem to be happening on my isolated tests.

[wedamirSarmat]

// Helper for 405
methodNotAllowed := func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusMethodNotAllowed)
}

// Explizit block
r.Put("/users/me", methodNotAllowed)
r.Patch("/users/me", methodNotAllowed)
r.Delete("/users/me", methodNotAllowed)

maybe it helps.

[pscheid92]

TL;DR:

• The Bug: If a static route (e.g., /users/me) exists but doesn't support a specific HTTP method, chi currently "falls through" to a matching param route (e.g., /users/{id}) instead of returning a 405.
• The Risk: Can lead to security bypasses or unintended behavior by treating reserved static paths as generic IDs.
• The Fix: Introduce a StrictRouting option to enforce static precedence and stop the traversal once a static path match is found.

---

Problem Understanding

When you define routes like this:

r.Get("/user/me", handleCurrentUser)
r.Put("/users/{id}", updateUser)

Which results in the following tree structure:

root
 └── /users (ntStatic)
      ├── /me (ntStatic) [leaf]
      │    └── endpoints:
      │         └── GET → handleCurrentUser
      │
      └── {id} (ntParam, tail='/') [leaf]
           └── endpoints:
                └── PUT → updateUser

A PUT /users/me request incorrectly routes to PUT /users/{id} instead of returning 405 Method Not Allowed. This is a surprising behaviour and can lead to security issues.

Expected Behaviour

PUT /users/me should return 405 Method Not Allowed because:

1. A static route /users/me exists
2. It just doesn't support the PUT method
3. Static routes should take full precedence over parametersized routes.

Actual Behaviour

PUT /users/me routes to PUT /users/{id} with id="me", potentially:

• Bypassing authorization checks intended for /users/me
• Treating special paths like /users/admin as regulard IDs
• Causing unexpected behaviour in API consumers

Root Cause Analysis

The issue is in tree.go:400-543 in the findRoute() function. Here's what happens:

1. Route tree structure:
   Both /users/me and /users/{id} share the /users prefix, so after matching /users, chi searches for child nodes to match /me

2. Node type traversal order:

   See the code around tree.go:404. Here Chi checks node types in order: ntStatic → ntRegexp → ntParam → ntCatchAll

3. The problem:

   In tree.go:506-524 the following happens:

   • Chi finds the static route /users/me
   • It doesn't have a PUT handler, so it sets methodNotAllowed = true (line 523)
   • BUT it continues to check param/regexp routes (line 528)
   • The param route /users/{id} does have PUT
   • Chi returns that handler instead of respecting the 405 Method Not Allowed

Solution Ideas

Since I expect some people relying on this by now, just changing it could be more than breaking. We could add a StrictRouting option field to the Mux struct that enforces static route precedence, though.

In the core routing logic tree.go:426 we then would exit early:

case ntParam, ntRegexp:
    // In strict routing mode, if a static route already matched the path
    // but with wrong method, stop here and don't fall back to param routes
    if rctx.strictRouting && rctx.methodNotAllowed {
        continue
    }

    // ... rest of param/regexp matching logic

Usage would look like this:

r := chi.NewRouter()
r.StrictRouting = true  // Enable strict routing

r.Get("/users/me", handleCurrentUser)
r.Put("/users/{id}", updateUser)

// PUT /users/me -> 405 Method Not Allowed ✓
// GET /users/me -> 200 OK ✓
// PUT /users/123 -> 200 OK (param route works normally) ✓

Depending on your opinion @pkieltyka @VojtechVitek, I can share my implementation (I already have one locally).