restatedev / restatedev/sdk-python
API validation is bypassed if content-type header is missing
Open
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 81
- Forks
- 22
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 2
Description
Hi everyone, I think we have found a bug in restates's API validation.
Given a service with 3 mandatory arguments make(str),year(str),model (int), we found that this request
curl --request POST \
--url 'http://restate:8080/Vins/notify_missing_suggested_vin/send' \
--header 'Content-Type: application/json'
fails with 400 status error and this message
{"message":"input validation error: Empty body not allowed"}
while this
curl --request POST \
--url 'http://restate:8080/Vins/notify_missing_suggested_vin/send'
succeeds, and creates an invocation with broken parameters
{"invocationId":"inv_1faXAMNrjkWq46yXz5nAKyjfuVEOa2rI7n","executionTime":"2025-05-29T02:20:35.027000000Z","status":"Accepted"}
which results in a never ending failing invocation since those empty parameters were actually expected.
Please let me know if you think we made a mistake filing this. Thanks for creating restate it is awesome.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.