Expose invalid request body in `handleValidationError` hook function arguments
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 20.8k
- Forks
- 2.3k
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 156
Description
Describe the problem
I'm not sure if the current behavior is intended or not, so I'm just filing this under a feature request.
Essentially, I've implemented the handleValidationError hook such that every invalid/malformed request to the remote function API endpoint gets reported to Sentry as a possible indicator of attack since it's very likely that someone is messing with that code:
export const handleValidationError: HandleValidationError = ({ issues, event }) => {
// send indicator of attack to Sentry
return {
message: 'Bad Request'
};
};
That works fine. However the issues is that I cannot read the request body using await event.request.json() because I get the following error:
TypeError: Body is unusable: Body has already been read
at consumeBody (node:internal/deps/undici/undici:6896:31)
at _Request.json (node:internal/deps/undici/undici:6847:18)
...
I suspect that this is due to SvelteKit already reading the request body before trying to validate it and pass it to the relevant remote function. As expected, event.request.bodyUsed is set to true.
I'm not aware of any other way that would allow me to read the request body (which I'd then need to decode from Base64 anyway). I feel like it's pretty important to be able to do so, to be able to discern between a bug (or a stale app version in the browser) and someone potentially probing the app for vulnerabilities.
Describe the proposed solution
The higher-order SvelteKit code passes the invalid request body to the handleValidationError handler function, as a parameter, alongside issues and event. To make it even cleaner, that data could perhaps even already be decoded from Base64.
Alternatives considered
I also tried to use await event.request.text(), getRequestEvent() and event.request.body, but they naturally all suffer from the same issues.
Importance
would make my life easier
Additional Information
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the handleValidationError hook and the remote function API request-validation path described in the issue. Trace where the request body is consumed before issues and event are passed to the handler. Done means the handler receives the invalid request body, with its expected encoding or decoding behavior defined and covered by the relevant validation tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100