title: Uncaught Slim\Exception\HttpMethodNotAllowedException: Method not allowed. Must be one of: GET
body: <p>I'm trying to implement firebase auth in my chrome extension and in my slim php REST API. After some configuration with the extension manifest and with the php server code I have a problem with the token verification. I always get this error when I try to pass the token I get from <code>chrome.identity.getAuthToken()</code>:</p>
  <pre><code>PHP Fatal error:  Uncaught Slim\Exception\HttpMethodNotAllowedException: Method not allowed. Must be one of: GET
  </code></pre>
  <p>The problem is that I'm using the get method on client side. My axios code is this:</p>
  <pre><code>      axios.get('http://localhost:3000/keygen', {
          headers: {
            'Authorization': `Bearer ${this.authToken}`
          }
        })
        .then( (response) =&gt; {
          console.log(response, response.data);
          this.password = response.data.generated_password;
          this.createdPassword = response.data.generated_password;
        });
  </code></pre>
  <p>and on the server side I have this code:</p>
  <pre><code>use Psr\Http\Message\ResponseInterface as Response;
  use Psr\Http\Message\ServerRequestInterface as Request;
  use Slim\Factory\AppFactory;
  
  
  require_once __DIR__.'/vendor/autoload.php';
  
  //I'm adding headers because I'm on localhost and I have a CORS error if I don't specify the chrome ectension id from witch the requests come from. This problem will not occur on live server
  header(&quot;Access-Control-Allow-Origin: chrome-extension://oegddbimpfdpbojkmfibkebnagidflfc&quot;);
  header(&quot;Access-Control-Allow-Methods: GET, POST&quot;);
  header(&quot;Access-Control-Allow-Headers: Authorization&quot;);
  header(&quot;Access-Control-Allow-Credentials: true&quot;);
  
  require_once __DIR__.'/vendor/autoload.php';
  
  $app = AppFactory::create();
  
  $rawPublicKeys = file_get_contents('https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com');
  $keys = json_decode($rawPublicKeys, true);
  
  $app-&gt;add(new Tuupola\Middleware\JwtAuthentication([
      //&quot;ignore&quot; =&gt; [&quot;&quot;]
      &quot;secret&quot; =&gt; $keys,
      &quot;header&quot; =&gt; &quot;X-Authorization&quot;,
      &quot;regexp&quot; =&gt; &quot;/Bearer\s+(.*)$/i&quot;,
      &quot;algorithm&quot; =&gt; [&quot;RS256&quot;],
  ]));
  
  $app-&gt;get('/keygen', function(Request $request, Response $response, $args){  
      $password = bin2hex(random_bytes(3));
      $response-&gt;getBody()-&gt;write( json_encode(['generated_password' =&gt; $password]) );
      return $response-&gt;withHeader('Content-Type','application/json');
  });
  </code></pre>
  <p>How I can fix this? I want to auth the user using firebase and identity api before give the user the ability to make requests to my api endopints. Thanks for the help.</p>
  <p><strong>EDIT</strong></p>
  <p>I've modified the php code following the slim provided documentation and now this issue seems solved but I get 401 error. I will post another question for this issue</p>
  <p>new code</p>
  <pre><code>$app-&gt;options('/{routes:.+}', function ($request, $response, $args) {
      return $response;
  });
  
  $app-&gt;add(function ($request, $handler) {
      $response = $handler-&gt;handle($request);
      return $response
              -&gt;withHeader('Access-Control-Allow-Origin', 'chrome-extension://oegddbimpfdpbojkmfibkebnagidflfc')
              -&gt;withHeader('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type, Accept, Origin, Authorization')
              -&gt;withHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, PATCH, OPTIONS');
  });
  
  $rawPublicKeys = file_get_contents('https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com');
  $keys = json_decode($rawPublicKeys, true);
  
  $app-&gt;add(new Tuupola\Middleware\JwtAuthentication([
      //&quot;ignore&quot; =&gt; [&quot;&quot;]
      &quot;secret&quot; =&gt; $keys,
      &quot;header&quot; =&gt; &quot;X-Authorization&quot;,
      &quot;regexp&quot; =&gt; &quot;/Bearer\s+(.*)$/i&quot;,
      &quot;algorithm&quot; =&gt; [&quot;RS256&quot;],
  ]));
  
  $app-&gt;get('/keygen', function(Request $request, Response $response, $args){  
      $password = bin2hex(random_bytes(3));
      $response-&gt;getBody()-&gt;write( json_encode(['generated_password' =&gt; $password]) );
      return $response-&gt;withHeader('Content-Type','application/json');
  });
  
  $app-&gt;map(['GET', 'POST', 'PUT', 'DELETE', 'PATCH'], '/{routes:.+}', function ($request, $response) {
      throw new HttpNotFoundException($request);
  });
  </code></pre>