Skip to content

feat(content-type): add strictContentTypeHeaderValidation option - #6926

Closed
bcomnes wants to merge 3 commits into
fastify:mainfrom
bcomnes:bret/content-type-validation-option
Closed

bcomnes wants to merge 3 commits into
fastify:mainfrom
bcomnes:bret/content-type-validation-option

Conversation

@bcomnes

@bcomnes bcomnes commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

I reworked #6918 into an option.

Adds a default-on strictContentTypeHeaderValidation server option for applications that must accept known and unknown malformed Content-Type request headers from clients they cannot control. It basically adds an option to switch lib/handle-request.js back to not validating before consulting the array of registered content type header handlers.

Behavior

Default behavior is unchanged:

  • invalid Content-Type header values are rejected with 415 FST_ERR_CTP_INVALID_MEDIA_TYPE
  • no body parser is consulted

With strictContentTypeHeaderValidation: false:

  • RegExp parsers can match the raw malformed header value
  • a catch-all parser can handle the raw malformed header value
  • an explicit parser is still required; otherwise Fastify returns 415
  • string parsers remain valid-media-type registrations only
  • malformed input preserves the existing request.mediaType behavior ("/")
  • schema.body.content cannot select a narrowed validator for malformed input

Checklist

@github-actions github-actions Bot added documentation Improvements or additions to documentation typescript TypeScript related labels Aug 8, 2026
@bcomnes bcomnes changed the title Bret/content type validation option Add strictContentTypeHeaderValidation option Aug 9, 2026
@jean-michelet

Copy link
Copy Markdown
Member

I prefer your doc PR that fixes the issue with a onRequest hook.

@bcomnes

bcomnes commented Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Got this rebased.

@Tony133
Tony133 requested a review from a team August 28, 2026 11:11
@bcomnes bcomnes changed the title Add strictContentTypeHeaderValidation option feat(content-type): add strictContentTypeHeaderValidation option Aug 28, 2026

@metcoder95 metcoder95 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe that this should be also doable per route and not only per-context; we are already partially doing so, then the effort must be minimal

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you add tests per route?

Comment thread docs/Reference/Server.md
you cannot control. In that mode, RegExp and catch-all content-type parsers can
match the raw invalid header value.

Malformed values do not produce a valid `request.mediaType` and therefore do

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs an example to disambiguate how to handle invalid content-types

@bcomnes
bcomnes force-pushed the bret/content-type-validation-option branch from 33bbb37 to fd80f2a Compare October 9, 2026 16:22
@bcomnes

bcomnes commented Oct 9, 2026

Copy link
Copy Markdown
Contributor Author

I rebased and fixed up this PR.

@bcomnes

bcomnes commented Nov 8, 2026

Copy link
Copy Markdown
Contributor Author

Closing in favor of #6927

@bcomnes bcomnes closed this Nov 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation typescript TypeScript related

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants