blade-method-field

#Why

A browser only sends GET or POST from a form, whatever the method attribute says. Writing method="DELETE" does not produce a DELETE request; the browser falls back to GET, and the route expecting DELETE is never reached.

Laravel's answer is to post the real verb in a hidden _method field, which @method('DELETE') writes. The form itself stays method="POST".

#Examples

#Bad

<!-- HTML doesn't support PUT: the browser falls back to GET, Laravel never
     sees the verb, and the CSRF token leaks into the query string -->
<form action="/users/1" method="PUT">
    @csrf
    <button>Update</button>
</form>

<!-- Same trap with DELETE -->
<form action="/users/1" method="DELETE">
    @csrf
    <button>Delete</button>
</form>

#Good

<!-- PUT request with @method -->
<form action="/users/1" method="POST">
    @csrf
    @method('PUT')
    <input name="name" value="{{ $user->name }}">
    <button>Update</button>
</form>

<!-- PATCH request with @method -->
<form action="/users/1" method="POST">
    @csrf
    @method('PATCH')
    <input name="email" value="{{ $user->email }}">
    <button>Update Email</button>
</form>

<!-- DELETE request with @method -->
<form action="/users/1" method="POST">
    @csrf
    @method('DELETE')
    <button>Delete User</button>
</form>

<!-- GET and POST don't need @method -->
<form action="/search" method="GET">
    <input name="q" placeholder="Search...">
</form>

<form action="/users" method="POST">
    @csrf
    <input name="name">
    <button>Create</button>
</form>

#HTTP Methods Reference

Laravel forms need @method when the intended method is not supported directly by HTML forms.

#Auto-fix

The fixer makes both edits at once: it rewrites the method attribute to POST and inserts the @method directive. Doing only one would leave a form the browser still submits as GET:

<!-- Before -->
<form action="/users/1" method="PUT">
    @csrf
</form>

<!-- After -->
<form action="/users/1" method="POST">
    @method('PUT')
    @csrf
</form>

The fix is dangerous and requires --dangerous, because changing the form from the browser's GET fallback to POST activates Laravel's method override and can turn it into a working PUT, PATCH, or DELETE request.

When an existing @method is conditional, the rule reports the form without offering a fix. Rewriting only the form to method="POST" would submit POST on paths where the directive does not render. Move the directive outside the condition, or include it in every branch, before fixing the form method.

#Notes

• This rule checks for method="PUT", method="PATCH", or method="DELETE" on forms
• Browsers only send GET or POST from a form, so Laravel reads the real verb from the _method field @method writes
• A form needing @method also needs @csrf
• Missing @method is not reported when the form body contains dynamic content such as {{ $slot }}, @include, @stack, @yield, a nested component, or a raw echo
• A method="POST" form with a hand-written <input type="hidden" name="_method" value="PUT"> works and is not flagged; @method('PUT') is the idiomatic way to write that input

#Related Rules

• security-csrf-field - Forms should include CSRF protection