Loosen Accept Header for */*

[lgebhardt]

The accept header is not matching ALL_MEDIA_TYPES when it should be. See #700 https://github.com/cerebris/jsonapi-resources/pull/700#issuecomment-239241977

The fix might be as simple as:

            (media_type == JSONAPI::MEDIA_TYPE || media_type.starts_with( ALL_MEDIA_TYPES) )

With a corresponding test:

  def test_accept_header_all_q
    @request.headers['Accept'] = "*/*;q=0.8"

    assert_cacheable_get :index
    assert_response :success
  end

[shunwen]

@lgebhardt Do you think it can rely on Rails's request.accepts instead of ActsAsResourceController#media_type_for ? We can also remove the MEDIA_TYPE_MATCHER regex.

[lgebhardt]

@shunwen That looks like it should work.

[jerelmiller]

I've confirmed that request.accepts strips media type parameters, so it is does not properly validate that the JSON API media type has not been modified with media type parameters. Same goes for Content-Type. Note this is tested in Rails 4.2.5, but not currently Rails 5.

It looks like ActsAsResourceController#media_type_for is our best bet to catch media type parameters for scenarios requests need to be checked for it.

[pixelhandler]

@lgebhardt @jerelmiller on a related subject it would be great if ActsAsResourceController#valid_accept_media_type? could accept "application/vnd.api+json;version=1"

For example, I use https://github.com/EDMC/api-versions

So maybe:

def valid_accept_media_type?
  media_types = media_types_for('Accept')

  media_types.blank? ||
    media_types.any? do |media_type|
      (media_type.start_with?(JSONAPI::MEDIA_TYPE) || media_type.start_with?(ALL_MEDIA_TYPES))
    end
end