Does FastAPI validate request Content-Type header and respond with 415 status when needed?

[EldarSehayekZenity]

First Check

• I added a very descriptive title here.
• I used the GitHub search to find a similar question and didn't find it.
• I searched the FastAPI documentation, with the integrated search.
• I already searched in Google "How to X in FastAPI" and didn't find any information.
• I already read and followed all the tutorial in the docs and didn't find an answer.
• I already checked if it is not related to FastAPI but to Pydantic.
• I already checked if it is not related to FastAPI but to Swagger UI.
• I already checked if it is not related to FastAPI but to ReDoc.

Commit to Help

• I commit to help with one of those options 👆

Example Code

from fastapi import FastAPI

app = FastAPI()

@app.post("/")
def echo(body: str = Body(media_type="text/plain")):
   return body

Description

• Open postman or some other API client and call the endpoint such that Content-Type header is "application/json", and body is the string "response text"
• It returns 200 OK response with body "response text"
• But I expected it to return of 415 Unsupported Media Type error response

Operating System

Windows

Operating System Details

No response

FastAPI Version

0.95.0

Python Version

3.10.4

Additional Context

I don't only expect FastAPI to return 415, I also expect it to be returned by raising an internal HTTPException so a custom exception handler can intercept it and return my own error response from it. Should I implement a custom FastAPI middleware to validate Content-Type matches the body param's media type?

[mateoradman]

I am by no means an expert in how parsing requests works in FastAPI, but from what I can see in routing.py, Content-Type header is checked for the params.Body field.

There are 2 logical branches:

• If the request does not have Content-Type header set or content type is application/json or application/+json, request.json() method is called.
• else, request.body() method is called which returns the request body as bytes and it is passed on to the dependency resolver, and then later to the endpoint func.

All in all, this means that your body will be parsed no matter what you pass to the Body field's media_type argument. It is most likely used for generating OpenAPI schema and that's it.

[leo-kling]

Should I implement a custom FastAPI middleware to validate Content-Type matches the body param's media type?

I would say yes.

I ran into the same problem today.

Worked well in local with PostMan but got an internal error when using curl to call my Cloud Run app. I forgot to put the content-type and my code just exploded.

Here's how I've fixed it using FastAPI Dependencies and Header Parameters :

from app.models import PydanticModel
from fastapi import APIRouter, Request, Response, HTTPException, Header, Depends


router = APIRouter()


def validate_content_type(content_type: str = Header(default=...)) -> None:
    """Refuse call that doesn't use the correct content-type"""
    if content_type != "application/json":
        raise HTTPException(
            status_code=415,
            detail="Unsupported Media Type. Content-Type must be 'application/json'",
        )
 

@router.post(path="/random_request", dependencies=[Depends(dependency=validate_content_type)])
def random_request(
    request: Request,
    pydantic_model: PydanticModel,
) -> Response:
    """Random Request"""

    # HTTP request without content-type application/json will be refused here

I'm using Python3.11 and FastAPI 0.115.3.

[vazome]

This may not work with multipart uploads like list[UploadFile] (even though this is easily addressed) and as I thought we would need to wait before all files in case of list[UploadFile] and single file UploadFile are uploaded, unnecessary loading the backend and adding a security risk.

Here is a good solution: https://stackoverflow.com/a/76396682/10897030