adobe / adobe/helix-shared

[body-data] handle body in requests without content-type header

Open
#1,005 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
15
Forks
16
Avg merge
23h 18m
Merged PRs (30d)
14

Description

Right now it looks like if a request is missing `content-type` but contains a body, the body is never consumed and instead only the search params are treated as data

in this case maybe we can either:
1. implicitly read the body as text, and attempt JSON parsing, but ignore any error that may occur (and treat as empty body, continue to read the search params as the data)
2. reject the request with a 400

In the last 7 days it looks like we received [~25k POSTs](https://helix.coralogix.com/#/query-new/logs?id=4HWCHwfMBvV&page=0) with a body and no content-type to admin (excluding `/hook/github` and `/hook/slack`) so option 2 might be too aggressive.

I'm unsure of how/if those bodies are being handled at the moment, though. Maybe they're quietly being treated as empty bodies and the client is unaware the request is being handled differently than they expect? wdyt @tripodsan?

see also https://github.com/adobe/helix-admin/issues/2570

Contributor guide

Open the contributing guide

Research direction

Start by tracing how requests with a body but no content-type are currently handled, then review the related issue #2570 and the reported production behavior. Done means the project has a decided policy for these requests and handles their bodies consistently without unexpectedly dropping data.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
api, backend
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.