Altinn / Altinn/app-lib-dotnet

InstanceController.Post doesn't handle unknown Content-Type correctly

Open
#164 0 comments 0 reactions 1 assignee Claimed by @ivarne View on GitHub
kind/bug
Dominant language
C#
Stars
8
Forks
27
Avg merge
1h 21m
Merged PRs (30d)
7

Description

## Describe the bug
If a user or application owner forgets to set the Content-Type of the body of the request to application/json, then the logic of the controller will be unable correctly parse the body content of the request.

Basic example:
POST http://altinn3local.no/ttd/bli-applikasjonseier/instances/
```
{
"appId" : "ttd/bli-applikasjonseier",
"instanceOwner": {
"personNumber": "01039012345",
"organisationNumber": null
}
}
```

One thing that complicates this quite a bit is that the logic have support for multipart requests. Only one of them need to be the instance template where application/json is the required Content-Type.

The request also supports empty body if party id is given as a query parameter. As I write this I'm unsure if this query parameter can be combined with a multipart request without an instance template.

## To Reproduce
Steps to reproduce the behavior:
1. Craft a request where the Content-Type is undefined (not set)
2. Send the request as an application owner.
3. The error will be something like this: `Cannot lookup party: Failed to lookup party by personNumber: 01039012345. The exception was: 404 - Not Found - `.

## Expected behavior
The controller should return status code 415 - Unsupported Media Type.

## Additional info
> Add any other relevant context info about the problem here.
> For example OS (Windows, MacOS, iOS), browser (Chrome, Firefox, Safari), device (iPhone, laptop), screen-size, etc.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.