search

mservicetech / openapi-schema-validation

Apache License 2.0
15 stars 9 forks source link

Response validation returns 400 Bad Request #45

Closed david0 closed 3 months ago

david0 commented 4 months ago

In v2.0.9 400 Bad Request is returned when the validation of the response fails.

I think its not the clients fault, so 400 is not appropriate, especially since its not about the request.

From my point of view an 5xx series error code, maybe just 500 is what should be returned in this case.

stevehu commented 4 months ago

@david0 I agree that 400s are client-side errors and 500s are server-side errors. When the server response is invalid against the server specification, the 502 Bad Gateway error seems better. @GavinChenYan @daglem, what do you think?

daglem commented 4 months ago

@david0 I agree that 400s are client-side errors and 500s are server-side errors. When the server response is invalid against the server specification, the 502 Bad Gateway error seems better. @GavinChenYan @daglem, what do you think?

I think 500 Internal Server Error is the better choice here, since invalid responses would normally originate from the server (application) itself, and must be fixed there. 502 Bad Gateway would imply that the server is only acting as a gateway or proxy, and that the problem lies elsewhere.

It is of course up to the server application whether a failed response validation should actually cause the request to fail, or if the validation error should only be logged for later investigation.