Skip to content

Consider removing #[serde(deny_unknown_fields)] from request types #750

Closed
@ramosbugs

Description

@ramosbugs

#666 added #[serde(deny_unknown_fields)] to ApiGatewayProxyRequest and other request types:

Using this serde attribute causes deserialization to fail if any unexpected fields are included in the request payload. This has two negative consequences:

  1. Due to Bug: sam local includes extraneous version attribute in ApiGatewayLambdaEvent (incompatible with aws-lambda-rust-runtime) aws/aws-sam-cli#6442, Lambda functions written using this library cannot be tested with versions of sam local from the past 3 years. This is a bug in aws-sam-cli, not the aws_lambda_events crate, but it illustrates a downside to strict request parsing.
  2. If the Amazon API Gateway team were to add a new feature that involved a new request field, all deployed Rust Lambda functions using the Lambda proxy integration might immediately break in production. In most APIs, adding a new field is not considered a breaking change. Unless there's a guarantee from that team never to add additional fields, this could be a ticking time bomb.

Unless there's a strong reason to reject request payloads with unknown fields that outweighs these downsides, I'd recommend removing deny_unknown_fields.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions