Using `base_url` changes the behavior of server validation

[jonathanberthias]

Actual Behavior

Specifying the base_url argument to validate_request makes the server validation fail, where my server spec is as:

servers:
  - url: /v1

and I'm trying to send a request to https://www.example.org/v1/hello.

I have narrowed the issue to the fact that the base_url argument to validate_request changes the server url from /v1 to file:///v1 (since the spec is stored locally), which cannot match the requested path, and raises a ServerNotFound exception.

I have to use base_url because I have an OpenAPI spec which is split in many files.

Expected Behavior

This is an issue since having a spec without any refs, so for which I can validate_request without base_url, works as expected.

To me, the issue stems from relying on the fact that the url used to resolve refs is the same as the server url.

Steps to Reproduce

Here are minimal files to reproduce using Starlette (though I believe the issue is not related to Starlette):

openapi.yaml

openapi: "3.1.0"
info:
  title: "hi"
  version: "1.0"
servers:
  - url: /v1
paths:
  /hi:
    get:
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: string

request.py

from openapi_core import Spec, validate_request
from openapi_core.contrib.starlette import StarletteOpenAPIRequest
from openapi_spec_validator.readers import read_from_filename
from starlette.requests import Request

async def receive():
    return {"type": "http.request"}

starlette_request = Request(
    scope={
        "type": "http",
        "scheme": "https",
        "method": "GET",
        "path": "/hi",
        "query_string": "",
        "headers": [(b"content-type", b"application/json")],
        "server": ("www.example.org/v1", 443),
    },
    receive=receive,
)

openapi_content, uri = read_from_filename("openapi.yaml")
spec = Spec.from_dict(openapi_content)

adapter = StarletteOpenAPIRequest(starlette_request)
validate_request(adapter, spec)  # OK
validate_request(adapter, spec, base_url=uri)  # ServerNotFound: Server not found for https://www.example.org/v1/hi

OpenAPI Core Version

0.17.2,0.18.0

OpenAPI Core Integration

Starlette

Affected Area(s)

validation

References

I think this might be the same error as #572 which was closed without resolution.

Anything else we need to know?

No response

Would you like to implement a fix?

No

[p1c2u]

Hi @jonathanberthias

thanks for the report.

the issue stems from relying on the fact that the url used to resolve refs is the same as the server url.

You're right with this one. Many version ago they were tightly coupled, but it should be fairly easy to split them at this point.

validate_request(adapter, spec, base_url=uri)  # ServerNotFound: Server not found for https://www.example.org/v1/hi

I think this one should fail still. The only change I would make is to give possibility to declare spec_uri for specification so it won't trigger server validation.

validate_request(adapter, spec, spec_uri=uri)

This one shouldn't trigger ServerNotFound.

Even better solution would be a possibility to pass referencing registry down to SchemaAccessor

[jonathanberthias]

Having a spec_uri argument separate from base_url would be great! Thanks!

[p1c2u]

Hi @jonathanberthias

I don't know how but I totally forgot the spec base url is settable already.

Did you try this:

openapi_content, uri = read_from_filename("openapi.yaml")
spec = Spec.from_dict(openapi_content, base_url= uri)

[jonathanberthias]

@p1c2u Thanks! Using the url on the spec and not when validating works like a charm! I guess I didn't see that parameter because it was hidden under the **kwargs.