Repository navigation
Keep the validated request body value by default - #91
Merged
mromaszewicz merged 1 commit intoOct 23, 2026
Merged
Conversation
kin-openapi's openapi3filter.Options.KeepValidatedValue makes ValidateRequest leave the decoded, validated body value on req.Body behind a ValidatedValue() any method, while the body stays readable. oapi-codegen's strict net/http server is being changed to bind that value instead of decoding the body a second time (oapi-codegen/oapi-codegen#2605). That closes a validation bypass: encoding/json matches object members case-insensitively, so a body such as {"role":"user","ROLE":"admin"} validates as role: user but binds as Role: "admin". For the fix to apply by default, this middleware has to turn the flag on by default. The middleware now validates with a copy of Options.Options that has KeepValidatedValue set, computed once when the middleware is built, in both the ErrorHandlerWithOpts and the ErrorHandler paths. With no Options (OapiRequestValidator), it uses openapi3filter.Options with only KeepValidatedValue set, where kin's defaults applied before. The caller's Options struct is not modified. The new Options.DiscardValidatedValue opts out, for instance to limit memory retention for very large request bodies, and overrides Options.Options.KeepValidatedValue. The README notes that a middleware placed after the validator that replaces r.Body (decompression, size limiting, logging wrappers) hides the validated value, so such middleware belongs before the validator. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enables kin-openapi's
openapi3filter.Options.KeepValidatedValueby default, with an opt-out.With the flag on, the request body that reaches the handler exposes the value the validator decoded and validated through a
ValidatedValue() anymethod. The body itself stays fully readable. oapi-codegen strict servers are being changed (oapi-codegen/oapi-codegen#2605) to bind that value instead of decoding the body a second time, which closes a validation bypass:encoding/jsonmatches member names case-insensitively, so{"role":"user","ROLE":"admin"}validates asrole: userbut binds asRole: "admin". Defaulting the flag here makes that fix effective without configuration.Changes:
Options.DiscardValidatedValueturns the flag back off, for example to limit memory retention for very large bodies. It overridesOptions.Options.KeepValidatedValue.openapi3filter.Optionsis copied, never mutated; nil options now get{KeepValidatedValue: true}.KeepValidatedValue: true), andExcludeRequestBody, and check the body still reads the original bytes.Requires kin-openapi v0.151.0 or later;
mainis on v0.152.0.🤖 Generated with Claude Code