Repository navigation
Keep the validated request body value by default - #16
Closed
mromaszewicz wants to merge 1 commit into
Closed
mromaszewicz wants to merge 1 commit into
mromaszewicz wants to merge 1 commit into
Conversation
oapi-codegen strict servers are being changed (oapi-codegen/oapi-codegen#2605) to bind the request body value that openapi3filter actually validated, rather than decoding the raw body a second time. Decoding twice lets a request slip past validation: encoding/json matches object members case-insensitively, so {"role":"user","ROLE":"admin"} validates as role: user but binds as Role: "admin". kin-openapi's openapi3filter.Options.KeepValidatedValue makes ValidateRequest leave the decoded, validated value on the request body behind a ValidatedValue() any method. Enable it by default, as in the other oapi-codegen middlewares, and add Options.DiscardValidatedValue as an opt-out for callers that want to drop the decoded value after validation (e.g. to limit memory retention for very large bodies). The opt-out overrides Options.Options.KeepValidatedValue. The middleware now passes a copy of the caller's openapi3filter.Options, so the caller's struct is never mutated; with no Options it passes &openapi3filter.Options{KeepValidatedValue: true}. In this middleware the setting is currently inert for Fiber handlers: ValidateRequestFromContext validates an *http.Request built by adaptor.ConvertRequest, which is a fresh request whose body reads from a copy of the fasthttp body bytes. Nothing openapi3filter writes to that request reaches the Fiber handler, which still reads c.Body(). The default and opt-out are added now for consistency and for a later change that exposes the validated value to handlers; the doc comment and README say so. Tests cover the option mapping (nil, zero, opt-out, override of KeepValidatedValue, other fields preserved, caller's struct not mutated) and check that valid and invalid requests behave identically with the default and with DiscardValidatedValue, with handlers seeing the original body. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Member
Author
|
I changed my mind, I don't want a non-functional flag for symmetry with other middleware. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enables kin-openapi's
openapi3filter.Options.KeepValidatedValueby default, with an opt-out, for consistency with the other oapi-codegen middlewares.With the flag on, openapi3filter leaves the value it decoded and validated on the validated request's body behind a
ValidatedValue() anymethod, which oapi-codegen strict servers are being changed to bind (oapi-codegen/oapi-codegen#2605). This middleware validates anet/httprequest produced byadaptor.ConvertRequest, a copy, so Fiber handlers do not yet observe the value and there is no behaviour change for them. The README and the field's doc comment say so. Exposing it to Fiber handlers (for example viac.Locals) is a follow-up.Changes:
Options.DiscardValidatedValueturns the flag back off. It overridesOptions.Options.KeepValidatedValue.openapi3filter.Optionsis copied, never mutated; nil options now get{KeepValidatedValue: true}.Requires kin-openapi v0.151.0 or later;
mainis on v0.152.0.🤖 Generated with Claude Code