[Bug]: Lowercase HTTP methods cause Envoy routing 404

Please select the area the issue is related to

Area/Management (Management API or Management Portal UI), Area/Gateway (Routing, API deployment in gateway etc.)

Please select the aspect the issue is related to

Aspect/API (API backends, definitions, contracts, interfaces, OpenAPI)

Description

API configuration validation allowed lowercase HTTP methods (such as get, post, etc.) to pass successfully. However, because these methods were stored as lowercase strings, the xDS translator generated Envoy route matches targeting lowercase methods. Standard HTTP clients send uppercase methods (e.g. GET), causing route-matching to fail with a 404 Not Found.

Root Cause

In api_validator.go, the method validation was checking if strings.ToUpper(string(op.Method)) was a valid HTTP method:

} else if !validMethods[strings.ToUpper(string(op.Method))] {
    // ...
}

This correctly identified get as representing a valid method name, but the config struct itself was left unmodified (storing the lowercase "get").

At translation time, translator.go mapped this directly into Envoy's :method exact matcher:

r.Match = &route.RouteMatch{
    Headers: []*route.HeaderMatcher{{
        Name: ":method",
        HeaderMatchSpecifier: &route.HeaderMatcher_StringMatch{
            StringMatch: &matcher.StringMatcher{
                MatchPattern: &matcher.StringMatcher_Exact{
                    Exact: method, // matched "get" exactly
                },
            },
        },
    }},
}

Since HTTP requests carry uppercase :method headers (like "GET"), Envoy's exact string matching failed.

Impact

Any API configured with lowercase HTTP methods (e.g., get instead of GET) would successfully deploy to the gateway controller database but experience routing failures (404 Not Found) at runtime.

Steps to Reproduce

1. Deploy an API configuration where one of the HTTP operations uses a lowercase method (e.g., method: get):

   apiVersion: gateway.api-platform.wso2.com/v1alpha1
   kind: RestApi
   metadata:
     name: weather-api
   spec:
     context: /weather
     upstream:
       main:
         url: http://weather-backend:8080
     operations:
       - method: get
         path: /today
   

2. The API deployment succeeds with 201 Created because the validator accepts lowercase methods.

3. Make an HTTP request through Envoy (the router) to the deployed route:

   curl -i -X GET http://localhost:8081/weather/today
   

4. Expected Result: The request is successfully routed to the backend upstream.

5. Actual Result: Envoy returns a 404 Not Found response because the route only matches the literal lowercase get, while the request carries GET.

Severity Level of the Issue

Severity/Minor (Non-critical functionality. Can be fixed in future releases)

Environment Details (with versions)

• Operating System: Windows
• Go Version: go1.26.2
• Git Version: 2.53.0.windows.1
• Docker Version: 29.1.4-rd, build 3c6914c
• Envoy Router Version: v1.35.3 (envoyproxy/envoy:v1.35.3)
• Gateway-Controller Version: 0.0.1-SNAPSHOT