Validate Content-Type header for REST API requests #6818

New Issue

adam · 2025-12-29T19:45:45+01:00

adam commented

2025-12-29 19:45:45 +01:00

Originally created by @jeremystretch on GitHub (Aug 16, 2022).

Originally assigned to: @jeremystretch on GitHub.

NetBox version

v3.2.9

Feature type

New functionality

Proposed functionality

Implement logic to check that the Content-Type header for inbound REST API requests has been properly set to application/json, and return an error if missing or invalid.

Use case

Currently, if a REST API request is made to create an object without specifying the correct content type, validation will fail reporting missing required fields. This is because the serializer (which expects JSON data) is not properly processing the request. This can be very confusing to the user.

Database changes

No response

External dependencies

No response

Originally created by @jeremystretch on GitHub (Aug 16, 2022). Originally assigned to: @jeremystretch on GitHub. ### NetBox version v3.2.9 ### Feature type New functionality ### Proposed functionality Implement logic to check that the `Content-Type` header for inbound REST API requests has been properly set to `application/json`, and return an error if missing or invalid. ### Use case Currently, if a REST API request is made to create an object without specifying the correct content type, validation will fail reporting missing required fields. This is because the serializer (which expects JSON data) is not properly processing the request. This can be very confusing to the user. ### Database changes _No response_ ### External dependencies _No response_

adam added the status: accepted type: feature labels 2025-12-29 19:45:45 +01:00

adam closed this issue

2025-12-29 19:45:45 +01:00

adam commented

2025-12-29 19:45:45 +01:00

@jeremystretch commented on GitHub (Aug 18, 2022):

One way to approach this would be to omit any parsers other than JSONParser in the DRF settings:

    'DEFAULT_PARSER_CLASSES': [
        'rest_framework.parsers.JSONParser',
        # 'rest_framework.parsers.FormParser',
        # 'rest_framework.parsers.MultiPartParser'
    ],

This triggers a 415 error if the Content-Type header is not set:

{
    "detail": "Unsupported media type \"application/x-www-form-urlencoded\" in request."
}

@jeremystretch commented on GitHub (Aug 18, 2022): One way to approach this would be to omit any parsers other than `JSONParser` in the DRF settings: ```python 'DEFAULT_PARSER_CLASSES': [ 'rest_framework.parsers.JSONParser', # 'rest_framework.parsers.FormParser', # 'rest_framework.parsers.MultiPartParser' ], ``` This triggers a 415 error if the `Content-Type` header is not set: ``` { "detail": "Unsupported media type \"application/x-www-form-urlencoded\" in request." } ```

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#6818