Missing or incorrect Content-Type header in responses to Admin API #315

New issue

Closed

opened 2022-05-25 14:09:51 +00:00 by flora-five · 0 comments

flora-five commented

2022-05-25 14:09:51 +00:00

I've noticed that for error responses from the Admin API, although the response body is JSON, the Content-Type header has an incorrect value, application/xml:

$ curl -v http://localhost:3903/v0/status                                                             
...
< HTTP/1.1 403 Forbidden
< content-type: application/xml
< content-length: 138
< date: Wed, 25 May 2022 14:00:46 GMT
< 
{
  "code": "AccessDenied",
  "message": "Forbidden: Authorization token must be provided",
  "region": "garage",
  "path": "/v0/status"
}


$ curl -v -H 'Authorization: Bearer ...' http://localhost:3903/v0/status                              
...
< HTTP/1.1 403 Forbidden
< content-type: application/xml
< content-length: 138
< date: Wed, 25 May 2022 14:04:25 GMT
< 
{
  "code": "AccessDenied",
  "message": "Forbidden: Invalid authorization token provided",
  "region": "garage",
  "path": "/v0/status"
}

The successful responses don't have a Content-Type header:

$ curl -v -H 'Authorization: Bearer ...' http://localhost:3903/v0/status                 
< HTTP/1.1 200 OK
< content-length: 574
< date: Wed, 25 May 2022 14:07:41 GMT
< 
{
  "node": "...",
  "garageVersion": "cargo:0.7.0",
  ...
}

I've noticed that for error responses from the Admin API, although the response body is JSON, the Content-Type header has an incorrect value, `application/xml`: ``` $ curl -v http://localhost:3903/v0/status ... < HTTP/1.1 403 Forbidden < content-type: application/xml < content-length: 138 < date: Wed, 25 May 2022 14:00:46 GMT < { "code": "AccessDenied", "message": "Forbidden: Authorization token must be provided", "region": "garage", "path": "/v0/status" } $ curl -v -H 'Authorization: Bearer ...' http://localhost:3903/v0/status ... < HTTP/1.1 403 Forbidden < content-type: application/xml < content-length: 138 < date: Wed, 25 May 2022 14:04:25 GMT < { "code": "AccessDenied", "message": "Forbidden: Invalid authorization token provided", "region": "garage", "path": "/v0/status" } ``` The successful responses don't have a Content-Type header: ``` $ curl -v -H 'Authorization: Bearer ...' http://localhost:3903/v0/status < HTTP/1.1 200 OK < content-length: 574 < date: Wed, 25 May 2022 14:07:41 GMT < { "node": "...", "garageVersion": "cargo:0.7.0", ... } ```