eclipse-ee4j / eclipse-ee4j/jersey

POST requests without Content-Type header pass throught @Consumes check

Open
#3,264 6 comments 1 reaction 0 assignees View on GitHub
Priority: Major Type: Bug
Dominant language
Java
Stars
730
Forks
382
PR merge metrics
No merged PRs in 30d

Description

This is a reopen of #2908. If a request does not contain a Content-Type, Jersey will invoke a resource method with @Consumes, but section 3.5 of the JAX-RS 2.0 spec explicitly disallows this:

> An implementation MUST NOT invoke a method whose effective value of
> @Consumes does not match the request Content-Type header.

The justification given for closing #2908 was that Jersey needs to remain backwards compatible. I believe Java EE implementations must be compliant by default, but if this is deemed to not be possible, then please consider this to be an enhancement request and add an option to get standards compliant behavior.
#### Affected Versions
[2.22]

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.