Security & Validation

Request Validation

The Request Validation policy is used to validate incoming requests based on schemas in OpenAPI specifications.

When configured, any requests that do not conform to your OpenAPI schema will be rejected with a 400: Bad Request response containing a detailed error message (in JSON) explaining why the request was not accepted.

Configuration#

{
  "name": "my-request-validation-inbound-policy",
  "policyType": "request-validation-inbound",
  "handler": {
    "export": "RequestValidationInboundPolicy",
    "module": "$import(@zuplo/runtime)",
    "options": {
      "includeRequestInLogs": false,
      "logLevel": "info",
      "validateBody": "reject-and-log",
      "validatePathParameters": "log-only",
      "validateQueryParameters": "log-only"
    }
  }
}

Options#

  • name the name of your policy instance. This is used as a reference in your routes.
  • policyType the identifier of the policy. This is used by the Zuplo UI. Value should be request-validation-inbound.
  • handler/export The name of the exported type. Value should be RequestValidationInboundPolicy.
  • handler/module the module containing the policy. Value should be $import(@zuplo/runtime).
  • handler/options The options for this policy:
    • logLevel

      The log level to use when logging validation errors.

    • validateBody

      The action to perform when validation fails.

    • validateQueryParameters

      The action to perform when validation fails.

    • validatePathParameters

      The action to perform when validation fails.

    • validateHeaders

      The action to perform when validation fails.

    • includeRequestInLogs

      Whether to include the request in the logs.

Here's an example of how to specify a schema for validation in a request body in OpenAPI.

  "requestBody": {
    "description": "user to add to the system",
    "content": {
      "application/json": {
        "schema": {
          "type": "object",
          "properties": {
            "name": {
              "type": "string"
            },
            "age": {
              "type": "integer"
            }
          },
          "required": [
            "name",
            "age"
          ]
        }
      }
    }
  }

Was this article helpful?

Do you have any questions?Contact us
Check out ourproduct changelog