Add `rawBody` option to disable body parsing on server #705

nickgarlis · 2024-10-09T20:12:11Z

Problem

There are use-cases where it would be useful to disable body parsing even if the content-type is application/json. An example would be verifying Stripe's webhook signatures.

From their docs:

Stripe requires the raw body of the request to perform signature verification. If you’re using a framework, make sure it doesn’t manipulate the raw body. Any manipulation to the raw body of the request causes the verification to fail.

Proposal
Adding a rawBody flag on the contract could allow users to disable this automatic behavior when necessary.

Implementation
I was thinking of modifying the following function to something like this.

  const evaluateContent = async (request: TsRestRequest) => {
    if (request.method !== 'GET' && request.method !== 'HEAD') {
      if (request.headers.get('content-type')?.includes('json') && !schema.rawBody) {
        request['content'] = await request.json();
      } else if (request.headers.get('content-type')?.startsWith('text/') || schema.rawBody) {
        request['content'] = await request.text();
      }
    }
  };

If this is of interest then I could open a Pull Request with the proposed changes and some tests.

Additional context
I have only used the serverless Next handler and admittedly I haven't given this too much of a thought but perhaps this is something that the other handlers could benefit from ?

The text was updated successfully, but these errors were encountered:

antonio-ivanovski · 2024-11-01T09:37:28Z

Personally I have modified the JSON parsing of Express, not sure if the same approach is applicable for you.

application.use(
    express.json({
        verify: (req, _res, buf) => {
            if (req.url && options.rawBodyEndpoints?.includes(req.url)) {
                Object.assign(req, { rawBody: buf.toString() });
            }
        },
    }),
);

options.rawBodyEndpoints includes list of endpoints that should receive the rawBody.

On the consumer side, I have method for getting the rawBody param

export function requestRawBody(req: Request): string | Buffer | undefined {
    if (!('rawBody' in req)) return undefined;
    if (typeof req.rawBody === 'string' || Buffer.isBuffer(req.rawBody)) return req.rawBody;
    console.warn('rawBody is not a string or Buffer');
    return undefined;
}

nickgarlis added the enhancement New feature or request label Oct 9, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add `rawBody` option to disable body parsing on server #705

Add `rawBody` option to disable body parsing on server #705

Add rawBody option to disable body parsing on server #705

Add rawBody option to disable body parsing on server #705

Comments

Add `rawBody` option to disable body parsing on server #705

Add `rawBody` option to disable body parsing on server #705