This repository has been archived by the owner on Apr 26, 2024. It is now read-only.
Endpoints that accept empty bodies also accept the empty bodies with Content-Type: application/json, which seems suspect
#16393
Labels
T-Task
Refactoring, removal, replacement, enabling or disabling functionality, other engineering tasks.
Comments
erikjohnston
added
the
T-Task
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
e.g. Complement sends
POST /forgetwithout a JSON body, but it setsContent-Type: application/jsonanyway. Synapse is happy with that, but arguably shouldn't be.(Ignore the fact that this request is meant to require a JSON body #16366 for now)
It seems like we should hold clients to a JSON-encoded body if they go so far as to set the content-type in the request.
As at Synapse v1.92.
As a soft proposal, we could add warnings when this is violated to start with so we can track down any clients that might be relying on this.
The text was updated successfully, but these errors were encountered: