Repository navigation
Keep the validated request body value by default - #51
Merged
mromaszewicz merged 1 commit intoOct 23, 2026
Merged
Conversation
oapi-codegen strict servers decode the request body a second time after
this middleware has validated it. Because encoding/json matches object
members case-insensitively, a body such as {"role":"user","ROLE":"admin"}
validates against the spec as role: user but binds as Role: "admin",
bypassing validation (oapi-codegen/oapi-codegen#2605). The fix there is
for strict servers to bind the value that was actually validated.
kin-openapi's openapi3filter.Options.KeepValidatedValue leaves that value
on the request body: after validation, req.Body stays readable and also
implements ValidatedValue() any. Since this middleware validates
c.Request directly, handlers see that body. Enable the flag by default,
including for OapiRequestValidator(spec) and ValidateRequestFromContext
with nil options, so strict servers get the protection without any
configuration. The caller's openapi3filter.Options is copied, not
mutated.
Add Options.DiscardValidatedValue as the opt-out, e.g. to limit memory
retention for very large bodies; it overrides
Options.Options.KeepValidatedValue.
Middleware registered after the validator that replaces the request
body (decompression, size limiting, logging wrappers) hides the
validated value, so the README now says such middleware belongs before
the validator.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enables kin-openapi's
openapi3filter.Options.KeepValidatedValueby default, with an opt-out.With the flag on, the request body that reaches the handler exposes the value the validator decoded and validated through a
ValidatedValue() anymethod. The body itself stays fully readable. oapi-codegen strict servers are being changed (oapi-codegen/oapi-codegen#2605) to bind that value instead of decoding the body a second time, which closes a validation bypass:encoding/jsonmatches member names case-insensitively, so{"role":"user","ROLE":"admin"}validates asrole: userbut binds asRole: "admin". Defaulting the flag here makes that fix effective without configuration.Changes:
Options.DiscardValidatedValueturns the flag back off, for example to limit memory retention for very large bodies. It overridesOptions.Options.KeepValidatedValue.openapi3filter.Optionsis copied, never mutated; nil options now get{KeepValidatedValue: true}.KeepValidatedValue: true), andExcludeRequestBody, and check the body still reads the original bytes.Requires kin-openapi v0.151.0 or later;
mainis on v0.152.0.🤖 Generated with Claude Code