Repository navigation
Keep the validated request body value by default - #68
Merged
mromaszewicz merged 1 commit intoOct 23, 2026
Merged
Conversation
oapi-codegen strict servers are being changed to bind the value that openapi3filter validated rather than decoding the request body a second time (oapi-codegen/oapi-codegen#2605). That closes a validation bypass: encoding/json matches object members case-insensitively, so a body such as {"role":"user","ROLE":"admin"} validates as role: user but binds as Role: "admin". For the fix to apply by default, the middleware has to ask openapi3filter to keep the value. Enable openapi3filter.Options.KeepValidatedValue by default. After a body passes validation, the request body seen by handlers implements ValidatedValue() any, returning the decoded, validated value (defaults included), and stays readable as before. The middleware now validates with a copy of the caller's openapi3filter.Options, so the caller's struct is not modified; nil options (OapiRequestValidator, or ValidateRequestFromContext with nil) get the same default. Add Options.DiscardValidatedValue to opt out, for instance to limit memory retention for very large bodies. It overrides Options.Options.KeepValidatedValue. Any middleware placed after the validator that replaces the request body (decompression, size limiting, logging wrappers) hides the validated value from handlers, so such middleware belongs before the validator. The README documents this. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enables kin-openapi's
openapi3filter.Options.KeepValidatedValueby default, with an opt-out.With the flag on, the request body that reaches the handler exposes the value the validator decoded and validated through a
ValidatedValue() anymethod. The body itself stays fully readable. oapi-codegen strict servers are being changed (oapi-codegen/oapi-codegen#2605) to bind that value instead of decoding the body a second time, which closes a validation bypass:encoding/jsonmatches member names case-insensitively, so{"role":"user","ROLE":"admin"}validates asrole: userbut binds asRole: "admin". Defaulting the flag here makes that fix effective without configuration.Changes:
Options.DiscardValidatedValueturns the flag back off, for example to limit memory retention for very large bodies. It overridesOptions.Options.KeepValidatedValue.openapi3filter.Optionsis copied, never mutated; nil options now get{KeepValidatedValue: true}.KeepValidatedValue: true), andExcludeRequestBody, and check the body still reads the original bytes.Requires kin-openapi v0.151.0 or later;
mainis on v0.152.0.🤖 Generated with Claude Code