Altinn / Altinn/app-lib-dotnet
InstanceController.Post doesn't handle unknown Content-Type correctly
- Dominant language
- C#
- Stars
- 8
- Forks
- 27
- Avg merge
- 1h 21m
- Merged PRs (30d)
- 7
Description
## Describe the bug
If a user or application owner forgets to set the Content-Type of the body of the request to application/json, then the logic of the controller will be unable correctly parse the body content of the request.
Basic example:
POST http://altinn3local.no/ttd/bli-applikasjonseier/instances/
```
{
"appId" : "ttd/bli-applikasjonseier",
"instanceOwner": {
"personNumber": "01039012345",
"organisationNumber": null
}
}
```
One thing that complicates this quite a bit is that the logic have support for multipart requests. Only one of them need to be the instance template where application/json is the required Content-Type.
The request also supports empty body if party id is given as a query parameter. As I write this I'm unsure if this query parameter can be combined with a multipart request without an instance template.
## To Reproduce
Steps to reproduce the behavior:
1. Craft a request where the Content-Type is undefined (not set)
2. Send the request as an application owner.
3. The error will be something like this: `Cannot lookup party: Failed to lookup party by personNumber: 01039012345. The exception was: 404 - Not Found - `.
## Expected behavior
The controller should return status code 415 - Unsupported Media Type.
## Additional info
> Add any other relevant context info about the problem here.
> For example OS (Windows, MacOS, iOS), browser (Chrome, Firefox, Safari), device (iPhone, laptop), screen-size, etc.
Contributor guide
Assessment
This issue has not been assessed yet.