[LeSingh1]

Problem

When multiple overlapping parameterized route patterns all register the same HTTP method, a request with an unregistered method produces duplicate entries in the Allow response header.

Minimal reproduction (from #996):

r.Post("/article/1-2-3", ...)
r.Post("/article/{a}", ...)
r.Post("/article/{b}-{c}", ...)
r.Post("/article/{b}-{c}-{d}", ...)

// GET /article/1-2-3 → 405 with Allow: POST, POST, POST, POST

Each parameterized node that matched during route traversal independently appended POST to rctx.methodsAllowed []methodTyp. The methodNotAllowedHandler then wrote one Allow header value per slice entry — one per matched node — instead of one per distinct method.

Fix

Replace methodsAllowed []methodTyp in Context with a methodTyp bitmask. Since methodTyp is already defined as a bitmask of power-of-two constants, each candidate node can OR its methods into the bitmask (rctx.methodsAllowed |= endpoints) rather than append to a slice. methodNotAllowedHandler then iterates reverseMethodMap and emits one Allow header entry for each bit that is set — guaranteeing uniqueness without any extra allocation.

Changes

• context.go: methodsAllowed []methodTyp → methodsAllowed methodTyp; Reset() zeroes with = 0
• tree.go: two append(rctx.methodsAllowed, ...) → rctx.methodsAllowed |= endpoints
• mux.go: MethodNotAllowedHandler and methodNotAllowedHandler take a single methodTyp bitmask instead of ...methodTyp; handler iterates reverseMethodMap by bitmask
• mux_test.go: TestMethodNotAllowedNoDuplicates — regression test from the exact scenario in Duplicate HTTP methods in 405 Allow header #996

Test plan

• TestMethodNotAllowedNoDuplicates — asserts no duplicate values in Allow header and that POST is present
• Existing TestMethodNotAllowed still passes (2 distinct methods, GET and HEAD, each appear once)
• go test ./...

Fixes #996

[VojtechVitek]

Thanks everyone. I confirmed the issue and reviewed these competing PRs:

PR	Age	Approach
#1029	Oct 2025	Dedupe at the source in tree.go (slices.Contains before append)
#1040, #1096, #1124	Dec 2025 – Jul 2026	Near-identical: seen-map inside methodNotAllowedHandler
#1047	Feb 2026	slices.Sort + Compact in the handler
#1112	Jun 2026	Refactor methodsAllowed to a bitmask

Let's go with #1029, which looks like the cleanest zero-allocation fix.

Closing the other PRs as duplicates — thanks for the contributions, the approaches were all reasonable.

Thank you for your contribution!