search

matrix-org / synapse

Synapse: Matrix homeserver written in Python/Twisted.
https://matrix-org.github.io/synapse
Apache License 2.0
11.83k stars 2.13k forks source link

Endpoints that accept empty bodies also accept the empty bodies with `Content-Type: application/json`, which seems suspect #16393

Open reivilibre opened 1 year ago

reivilibre commented 1 year ago

e.g. Complement sends POST /forget without a JSON body, but it sets Content-Type: application/json anyway. Synapse is happy with that, but arguably shouldn't be. (Ignore the fact that this request is meant to require a JSON body #16366 for now)

It seems like we should hold clients to a JSON-encoded body if they go so far as to set the content-type in the request.

As at Synapse v1.92.

As a soft proposal, we could add warnings when this is violated to start with so we can track down any clients that might be relying on this.