[body-data] handle body in requests without content-type header
- Dominant language
- JavaScript
- Stars
- 15
- Forks
- 16
- Avg merge
- 23h 18m
- Merged PRs (30d)
- 14
Description
Right now it looks like if a request is missing `content-type` but contains a body, the body is never consumed and instead only the search params are treated as data
in this case maybe we can either:
1. implicitly read the body as text, and attempt JSON parsing, but ignore any error that may occur (and treat as empty body, continue to read the search params as the data)
2. reject the request with a 400
In the last 7 days it looks like we received [~25k POSTs](https://helix.coralogix.com/#/query-new/logs?id=4HWCHwfMBvV&page=0) with a body and no content-type to admin (excluding `/hook/github` and `/hook/slack`) so option 2 might be too aggressive.
I'm unsure of how/if those bodies are being handled at the moment, though. Maybe they're quietly being treated as empty bodies and the client is unaware the request is being handled differently than they expect? wdyt @tripodsan?
see also https://github.com/adobe/helix-admin/issues/2570
Contributor guide
Research direction
Start by tracing how requests with a body but no content-type are currently handled, then review the related issue #2570 and the reported production behavior. Done means the project has a decided policy for these requests and handles their bodies consistently without unexpectedly dropping data.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100