Validate an HTTP method against an allowlist

Challenge

Refuse unexpected HTTP methods with a tiny allowlist — a one-line defence against a class of cache-pollution and request-smuggling tricks.

Task

Implement int is_valid_http_method(const char *m) that returns 1 if m is exactly one of the allowed methods, else 0.

Allowed methods (case-sensitive, uppercase): GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH.

Input

• m: a NUL-terminated method string, or NULL. The grader passes a fixed set of strings.

Output

Returns int: 1 if m exactly matches an allowed method, else 0.

Example

is_valid_http_method("GET")     ->   1
is_valid_http_method("PATCH")   ->   1
is_valid_http_method("TRACE")   ->   0   (not allowed)
is_valid_http_method("get")     ->   0   (case-sensitive)
is_valid_http_method("CONNECT") ->   0   (intentionally excluded)
is_valid_http_method("")        ->   0
is_valid_http_method(NULL)      ->   0

Edge cases

• NULL and the empty string return 0.
• Lowercase or mixed-case (get, Get) return 0.
• Near-matches like GETT return 0.

Rules

• Exact, case-sensitive comparison; TRACE and CONNECT are deliberately excluded.

Why this matters

The first byte of every HTTP request is attacker-controlled. Refusing weird methods (TRACE, CONNECT, the legendary GETT) is a one-line defence that blocks an entire class of cache-pollution and request-smuggling tricks.

Input format

A NUL-terminated method string m, or NULL.

Output format

An int: 1 if m exactly matches an allowed method, else 0.

Constraints

Exact case-sensitive comparison; no allocations; TRACE/CONNECT excluded.

Starter code

int is_valid_http_method(const char *m) { /* TODO */ return 0; }

Common mistakes

Including TRACE (information-leak prone) or CONNECT (proxy tunneling). Doing a case-insensitive compare.

Edge cases to handle

NULL; empty; lowercase; near-matches like GETT.

Complexity

O(1) — constant work over a fixed table.

Background lessons

• HTTP/1.1 protocol structure
• Input validation

Up next

• Parse HTTP request line (method + path)
• Build an HTTP GET request