fix(form-urlencoded): do not claim a content-type it did not encode - #914
Conversation
Sharing a stack with Tesla.Middleware.JSON put two content-type headers on every JSON request, which a server is free to reject. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
PR SummaryMedium Risk Overview The rule is enforced in Docs describe the shared-stack behavior. Tests cover binary requests with no outgoing content-type and a JSON+FormUrlencoded stack asserting a single header for JSON vs tagged form bodies. Reviewed by Cursor Bugbot for commit 10b2429. Bugbot is set up for automated code reviews on this repo. Configure here. |
Tesla.Middleware.JSONand this middleware are meant to share one stack, but feat: support {:form,data} tagged body tuples #886 only wired up half of that handshake:JSONlearned to decline form-tagged bodies, while nothing taught this middleware to decline a bodyJSONhad already encoded.content-typeheaders on every JSON request from any client that also has a single form-encoded operation, and a server is free to reject that.JSON: in front of it, a struct body reaches the catch-all and raises.encodable?/1makes the rule uniform across both middlewares, which is that a middleware claims thecontent-typeprecisely when it encoded the body.content-type. That path was undocumented, the existing binary test only pinned the body and never the header, andTesla.Middleware.JSONhas behaved this way since 9514bd1.