eclipse-ee4j / eclipse-ee4j/jersey
POST requests without Content-Type header pass throught @Consumes check
- Dominant language
- Java
- Stars
- 730
- Forks
- 382
- PR merge metrics
- No merged PRs in 30d
Description
This is a reopen of #2908. If a request does not contain a Content-Type, Jersey will invoke a resource method with @Consumes, but section 3.5 of the JAX-RS 2.0 spec explicitly disallows this:
> An implementation MUST NOT invoke a method whose effective value of
> @Consumes does not match the request Content-Type header.
The justification given for closing #2908 was that Jersey needs to remain backwards compatible. I believe Java EE implementations must be compliant by default, but if this is deemed to not be possible, then please consider this to be an enhancement request and add an option to get standards compliant behavior.
#### Affected Versions
[2.22]
Contributor guide
Assessment
This issue has not been assessed yet.