Skip to content

fix: return 400 for malformed Content-Type header - #497

Merged
feugy merged 1 commit into
mainfrom
fix/invalid-content-type-400
Nov 5, 2026
Merged

feugy merged 1 commit into
mainfrom
fix/invalid-content-type-400

Conversation

@feugy

@feugy feugy commented Nov 5, 2026

Copy link
Copy Markdown
Member

🖖 What's in there?

Fixes a 500 on malformed Content-Type headers in buffer(), text() and json().

buffer() parses the charset with content-type while it builds the getRawBody() options, so the parse runs before the .catch() that maps body errors. A header like Content-Type: application/json; (trailing semicolon) throws a raw TypeError: invalid parameter format, so micro answers with a 500. The fix wraps the parse and throws createError(400, 'Invalid Content-Type header', err), like the existing Invalid JSON and Invalid body errors.

Before Now
500 Internal Server Error 400 Invalid Content-Type header

🤺 How to test?

curl -i -X POST localhost:3000 -H 'Content-Type: application/json;' -d '{}'

New tests in test/suite/index.ts:

  • json() returns 400 for application/json;, application/json; charset, application/json;; charset=utf-8 and application.
  • text() returns 400 for text/plain;.
  • buffer() with an explicit encoding still skips the parse.
  • json() still parses a body sent with application/json; charset=utf-8.

Without the fix, the 5 invalid-header tests fail with Internal Server Error.

🔬 Notes to reviewers

  • prettier-check in packages/micro fails on the generated types/*.d.ts files, also on main without this change.

🔗 Related PRs

buffer(), text() and json() parsed the Content-Type charset outside the error handling of getRawBody. A malformed header such as 'application/json;' threw a raw TypeError, which callers answered with a 500. It now throws a 400 HttpError with the message 'Invalid Content-Type header'.
@feugy
feugy merged commit 7f31454 into main Nov 5, 2026
5 checks passed
@feugy feugy mentioned this pull request Nov 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants