Why does Hono return 404 instead of 405 for unsupported HTTP methods?

[silvioprog]

Hono returns 404 when a route exists for a path but not for the requested HTTP method (e.g., POST sent to a GET route).

Is there a recommended way to return 405 Method Not Allowed instead, or a built-in pattern/middleware to handle this?

[Yaya12085]

@silvioprog you can use something like this

app.post('/hello', (c) => {
  return c.text('POST Hello Hono!')
}).all((c) => {
  return c.text('Method not allowed', 405)
})

[silvioprog]

Thanks! But this approach would require adding .all() to every single route, which doesn't scale well for larger APIs. 😕

Is returning 404 Not Found instead of 405 Method Not Allowed a deliberate design choice in Hono's router?

Is there any global hook / middleware / router-level configuration to detect "path matches but method doesn't" and automatically return 405?

Something like app.methodNotAllowed() (similar to app.notFound()), so we don't need to implement this per route.

[Yaya12085]

@silvioprog I don't know if this is the best option, but it works for me.

import { serve } from '@hono/node-server'
import { Hono } from 'hono'

const app = new Hono()


app.get("/", (c) => {
  return c.text("GET Hello Hono!");
});

app.post('/hello', (c) => {
  return c.text('POST Hello Hono!')
})
app.put('/hello', (c) => {
  return c.text('PUT Hello Hono!')
})

app.all((c) => {
  return c.text('Method not allowed', 405)
}).use("*",async (c) => {
  return c.text('API not found', 404);
})

serve({
  fetch: app.fetch,
  port: 3000
}, (info) => {
  console.log(`Server is running on http://localhost:${info.port}`)
})

I think it's a good approach on hono's part to return a 404 rather than a 405. For security reasons, I always prefer to return a 404 rather than saying that the method is not allowed.

Maybe in the future there will be a method app.methodNotAllowed that will automatically return a 405.

[silvioprog]

Thanks for the example!

I understand the security argument for returning 404 by default, and it makes sense in many cases. My concern is that Hono shouldn't enforce this as the only behavior, since the correct response really depends on the project. Some APIs need stricter HTTP semantics and expect 405, others prefer always returning 404.

That's why I suggested something like app.methodNotAllowed(): keep the current default, but provide a clean, global opt-in so each project can choose what fits its own requirements.

I just created a feature request here: #4633

[silvioprog]

Thanks for the discussion!

I've submitted a PR implementing app.methodNotAllowed() as an opt-in feature. It maintains the secure 404 default while allowing projects to return proper 405 responses when needed. 🙌

PR: #4637

[KeepALifeUS]

Solution: Return 405 Method Not Allowed in Hono

Hono returns 404 by default because it treats each method as a separate route. Here are ways to return 405:

Option 1: Use app.all() with method check

import { Hono } from "hono";

const app = new Hono();

// Define your actual route
app.get("/users", (c) => c.json({ users: [] }));

// Catch all other methods for same path
app.all("/users", (c) => {
  return c.text("Method Not Allowed", 405, {
    Allow: "GET"
  });
});

Option 2: Custom middleware

const methodNotAllowed = (allowedMethods: string[]) => {
  return async (c, next) => {
    if (!allowedMethods.includes(c.req.method)) {
      return c.text("Method Not Allowed", 405, {
        Allow: allowedMethods.join(", ")
      });
    }
    await next();
  };
};

// Usage
app.use("/users", methodNotAllowed(["GET", "POST"]));
app.get("/users", handler);
app.post("/users", handler);

Option 3: Custom 404 handler with method detection

app.notFound((c) => {
  // Check if path exists but method doesn't
  const path = c.req.path;
  const hasRoute = app.routes.some(r => r.path === path);
  
  if (hasRoute) {
    return c.text("Method Not Allowed", 405);
  }
  return c.text("Not Found", 404);
});

Option 1 is the simplest for individual routes. Option 2 scales better for many routes.