Enforce content type for POST requests

handler/graphql.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"mime"
 	"net/http"
 	"strings"
 	"time"
@@ -335,10 +336,24 @@ func (gh *graphqlHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			}
 		}
 	case http.MethodPost:
-		if err := jsonDecode(r.Body, &reqParams); err != nil {
-			sendErrorf(w, http.StatusBadRequest, "json body could not be decoded: "+err.Error())
+		mediaType, _, err := mime.ParseMediaType(r.Header.Get("Content-Type"))
+		if err != nil {
+			sendErrorf(w, http.StatusBadRequest, "error parsing request Content-Type")
+			return
+		}
+
+		switch mediaType {
+		case "application/json":
+			if err := jsonDecode(r.Body, &reqParams); err != nil {
+				sendErrorf(w, http.StatusBadRequest, "json body could not be decoded: "+err.Error())
+				return
+			}
+		default:
+			sendErrorf(w, http.StatusBadRequest, "unsupported Content-Type: "+mediaType)
 			return
 		}
+
+
 	default:
 		w.WriteHeader(http.StatusMethodNotAllowed)
 		return

handler/graphql_test.go

@@ -2,6 +2,7 @@ package handler
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -79,6 +80,49 @@ func TestHandlerPOST(t *testing.T) {
 		assert.Equal(t, resp.Header().Get("Content-Type"), "application/json")
 		assert.Equal(t, `{"errors":[{"message":"mutations are not supported"}],"data":null}`, resp.Body.String())
 	})
+
+	t.Run("validate content type", func(t *testing.T) {
+		doReq := func(handler http.Handler, method string, target string, body string, contentType string) *httptest.ResponseRecorder {
+			r := httptest.NewRequest(method, target, strings.NewReader(body))
+			if contentType != "" {
+				r.Header.Set("Content-Type", contentType)
+			}
+			w := httptest.NewRecorder()
+
+			handler.ServeHTTP(w, r)
+			return w
+		}
+
+		validContentTypes := []string{
+			"application/json",
+			"application/json; charset=utf-8",
+		}
+
+		for _, contentType := range validContentTypes {
+			t.Run(fmt.Sprintf("allow for content type %s", contentType), func(t *testing.T) {
+				resp := doReq(h, "POST", "/graphql", `{"query":"{ me { name } }"}`, contentType)
+				assert.Equal(t, http.StatusOK, resp.Code)
+				assert.Equal(t, `{"data":{"name":"test"}}`, resp.Body.String())
+			})
+		}
+
+		invalidContentTypes := []struct{ contentType, expectedError string }{
+			{"", "error parsing request Content-Type"},
+			{"text/plain", "unsupported Content-Type: text/plain"},
+
+			// These content types are currently not supported, but they are supported by other GraphQL servers, like express-graphql.
+			{"application/x-www-form-urlencoded", "unsupported Content-Type: application/x-www-form-urlencoded"},
+			{"application/graphql", "unsupported Content-Type: application/graphql"},
+		}
+
+		for _, tc := range invalidContentTypes {
+			t.Run(fmt.Sprintf("reject for content type %s", tc.contentType), func(t *testing.T) {
+				resp := doReq(h, "POST", "/graphql", `{"query":"{ me { name } }"}`, tc.contentType)
+				assert.Equal(t, http.StatusBadRequest, resp.Code)
+				assert.Equal(t, fmt.Sprintf(`{"errors":[{"message":"%s"}],"data":null}`, tc.expectedError), resp.Body.String())
+			})
+		}
+	})
 }
 
 func TestHandlerGET(t *testing.T) {
@@ -178,6 +222,7 @@ func TestHandlerComplexity(t *testing.T) {
 
 func doRequest(handler http.Handler, method string, target string, body string) *httptest.ResponseRecorder {
 	r := httptest.NewRequest(method, target, strings.NewReader(body))
+	r.Header.Set("Content-Type", "application/json")
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, r)