Skip to content

docs(contenttypeparser): new strict content-type validation - #6925

Merged
jsumners merged 9 commits into
fastify:mainfrom
bcomnes:bret/document-content-type-validation
Sep 2, 2026
Merged

docs(contenttypeparser): new strict content-type validation#6925
jsumners merged 9 commits into
fastify:mainfrom
bcomnes:bret/document-content-type-validation

Conversation

@bcomnes

@bcomnes bcomnes commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Document the request lifecycle boundary introduced by #6414:

  • malformed Content-Type values are rejected before body parser selection
  • string, RegExp, and catch-all parsers cannot recover invalid values
  • an onRequest hook can narrowly canonicalize known external input
  • repair must happen before request.mediaType is accessed and cached
  • broad recovery can undermine parser selection and schema.body.content guarantees

The example intentionally handles one exact malformed value and leaves every unrelated value under Fastify strict validation.

Checklist

@github-actions github-actions Bot added the documentation Improvements or additions to documentation label Aug 8, 2026
@bcomnes bcomnes mentioned this pull request Aug 8, 2026
Merged
jean-michelet
jean-michelet reviewed Aug 9, 2026
View reviewed changes
Comment thread docs/Reference/ContentTypeParser.md Resolved
@jean-michelet
jean-michelet requested a review from jsumners August 9, 2026 14:13
jean-michelet
jean-michelet reviewed Aug 9, 2026
View reviewed changes
Comment thread docs/Reference/ContentTypeParser.md Resolved
Fdawgs
Fdawgs suggested changes Aug 11, 2026
View reviewed changes
Comment thread docs/Reference/ContentTypeParser.md Resolved
@jsumners

jsumners commented Aug 12, 2026

Copy link
Copy Markdown
Member

I will look at this. But it's going to be a couple of days before I can.

@Fdawgs Fdawgs changed the title Document new strict content-type validation docs(contenttypeparser): new strict content-type validation Aug 12, 2026
@jean-michelet jean-michelet mentioned this pull request Aug 13, 2026
Open
2 tasks done
@maximilliangrand maximilliangrand mentioned this pull request Aug 13, 2026
Open
3 of 4 tasks
@bcomnes

bcomnes commented Aug 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

I will look at this. But it's going to be a couple of days before I can.

Don't yet, need to fix up. (Doing that now)

@jsumners

jsumners commented Aug 24, 2026

Copy link
Copy Markdown
Member

I will look at this. But it's going to be a couple of days before I can.

Don't yet, need to fix up. (Doing that now)

Please ping when ready.

@bcomnes

bcomnes commented Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

I ended up with unexpected travel last week. Will incorporate all open feedback in my open PRs this week.

@bcomnes

bcomnes commented Aug 27, 2026

Copy link
Copy Markdown
Contributor Author

Looking at these again, sorry for the delay.

@bcomnes
bcomnes force-pushed the bret/document-content-type-validation branch from 20d14e3 to 1776bf4 Compare August 27, 2026 23:58
@bcomnes

bcomnes commented Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

@jsumners ok! fixed up let me know what you think. Sorry for the delay.

jsumners
jsumners previously approved these changes Aug 28, 2026
View reviewed changes

@jsumners jsumners left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, but I prefer "rewrite" to "repair." Repair has a different connotation to me.

Comment thread docs/Reference/ContentTypeParser.md Resolved
Comment thread docs/Reference/ContentTypeParser.md Resolved
Comment thread docs/Reference/ContentTypeParser.md Resolved
@bcomnes

bcomnes commented Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Fixed up! Thank you for the review suggestion blocks.

bcomnes
bcomnes commented Aug 28, 2026
View reviewed changes
Comment thread docs/Reference/ContentTypeParser.md Resolved
@bcomnes

bcomnes commented Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Oh crap what did I do need to revert that last thing.

@bcomnes
bcomnes force-pushed the bret/document-content-type-validation branch from 5d2204b to e346e95 Compare August 28, 2026 17:47
@bcomnes

bcomnes commented Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Fixed.

@bcomnes

bcomnes commented Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Rewrite the header before accessing request.mediaType,
which parses and caches the current value.

Should fastify actually guard for this? (If mediaType is accessed before rewriting the header in onRequest).

@jsumners

jsumners commented Sep 2, 2026

Copy link
Copy Markdown
Member

Rewrite the header before accessing request.mediaType,
which parses and caches the current value.

Should fastify actually guard for this? (If mediaType is accessed before rewriting the header in onRequest).

🤷‍♂️ Seems like an edge case. But if you feel strongly about it, go for it.

@jsumners
jsumners requested a review from Fdawgs September 2, 2026 11:04
@Fdawgs
Fdawgs requested a balanced review from Copilot September 2, 2026 14:47

This comment was marked as low quality.

Sign in to view

@bcomnes

bcomnes commented Sep 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Seems like an edge case. But if you feel strongly about it, go for it.

Happy to revisit if its an issue people run into. Thank you for the review!

bcomnes and others added 9 commits September 2, 2026 18:12
@bcomnes @jsumners
docs: explain strict content-type validation
8648e99 
Signed-off-by: Bret Comnes <bret@comnes.org>
@bcomnes @jsumners
docs: address content-type validation review
fe27943
@bcomnes @jsumners
docs: clarify invalid content-type status
16b8125
@bcomnes @jsumners
docs: clarify content-type schema selection risk
00ac9b9
@bcomnes @jsumners
docs: incorporate content-type validation feedback
2716d3d 
Signed-off-by: Bret Comnes <bret@comnes.org>
@bcomnes @jsumners
docs: link content-type syntax specification
b731ea3 
Signed-off-by: Bret Comnes <bret@comnes.org>
@bcomnes @jsumners
Update docs/Reference/ContentTypeParser.md
66dafba 
Co-authored-by: James Sumners <321201+jsumners@users.noreply.github.com>
Signed-off-by: Bret Comnes <166301+bcomnes@users.noreply.github.com>
@bcomnes @jsumners
Apply batched suggestions from code review
aeb0a97 
Co-authored-by: James Sumners <321201+jsumners@users.noreply.github.com>
Signed-off-by: Bret Comnes <166301+bcomnes@users.noreply.github.com>
@bcomnes @jsumners
Clarify cannot/will not
6bc6f67
@jsumners
jsumners force-pushed the bret/document-content-type-validation branch from e346e95 to 6bc6f67 Compare September 2, 2026 22:12
@jsumners
jsumners merged commit af6e2e4 into fastify:main Sep 2, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@jsumners jsumners jsumners approved these changes
+2 more reviewers
@jean-michelet jean-michelet jean-michelet left review comments
@Fdawgs Fdawgs Fdawgs approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

documentation Improvements or additions to documentation

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@bcomnes @jsumners @Fdawgs @jean-michelet