Repository navigation
Keep the validated request body value by default - #49
Merged
mromaszewicz merged 1 commit intoOct 23, 2026
Merged
Conversation
oapi-codegen strict servers decode the request body a second time after
this middleware has validated it. Because encoding/json matches object
members case-insensitively, a body such as {"role":"user","ROLE":"admin"}
validates as role: user but binds as Role: "admin", bypassing validation.
oapi-codegen/oapi-codegen#2605 changes strict servers to bind the value
that was validated instead, which kin-openapi exposes when
openapi3filter.Options.KeepValidatedValue is set: the request body gains
a ValidatedValue() any method returning the decoded, validated value,
while remaining readable with its original bytes.
For that fix to take effect without extra configuration, the middleware
now enables KeepValidatedValue by default, both for
OapiRequestValidator(spec) and when Options are supplied. The caller's
openapi3filter.Options is copied rather than mutated. The new
Options.DiscardValidatedValue opts out, for example to limit memory
retention for very large request bodies, and overrides
Options.Options.KeepValidatedValue.
Since the middleware validates ctx.Request() in place, any middleware
registered after it that replaces the request body (decompression, size
limiting, logging wrappers) hides the validated value from handlers. The
README documents that such middleware belongs before the validator.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enables kin-openapi's
openapi3filter.Options.KeepValidatedValueby default, with an opt-out.With the flag on, the request body that reaches the handler exposes the value the validator decoded and validated through a
ValidatedValue() anymethod. The body itself stays fully readable. oapi-codegen strict servers are being changed (oapi-codegen/oapi-codegen#2605) to bind that value instead of decoding the body a second time, which closes a validation bypass:encoding/jsonmatches member names case-insensitively, so{"role":"user","ROLE":"admin"}validates asrole: userbut binds asRole: "admin". Defaulting the flag here makes that fix effective without configuration.Changes:
Options.DiscardValidatedValueturns the flag back off, for example to limit memory retention for very large bodies. It overridesOptions.Options.KeepValidatedValue.openapi3filter.Optionsis copied, never mutated; nil options now get{KeepValidatedValue: true}.KeepValidatedValue: true), andExcludeRequestBody, and check the body still reads the original bytes.Requires kin-openapi v0.151.0 or later;
mainis on v0.152.0.🤖 Generated with Claude Code