Group
  • Security

    Validate Content-Type on my API endpoints

    Rejects requests with unexpected content types so parsers and handlers only process what they were built for.

    • Improve quality
    • Beginner
    • General

Free Prompt

Add Content-Type validation to my API. For every endpoint that accepts a request body, define what content type it expects (usually application/json) and reject anything else with a 415 response before the body is parsed or handled. Check for the related parser pitfalls: multiple body parsers mounted globally so any content type gets parsed everywhere (multipart or urlencoded data reaching JSON-only endpoints); endpoints that silently accept whatever arrives and behave differently per type (a source of type-confusion and NoSQL-injection-style bugs where an object arrives when a string was expected); and missing error handling when a body is malformed JSON, which should return a clean 400, not a 500 stack trace. Do not break the frontend's existing requests; confirm what content types it actually sends and allow exactly those. Keep webhook endpoints working with their required raw bodies. Show me each endpoint's accepted types. Give me verification requests: a correct request that passes, a wrong-content-type request that gets a 415, and a malformed JSON body that gets a clean 400.

What This Does / How This Helps

Makes each endpoint strict about what content types it accepts, and turns malformed bodies into clean 400s instead of server errors. Loose parsing creates weird attack surface. An endpoint built for JSON that also accepts form-encoded or multipart data can be fed types the handler never expected, which is how type-confusion bugs and some injection paths open up. It also turns garbage input into 500s that clutter your logs and leak internals. The verification trio (right type passes, wrong type gets a 415, malformed body gets a 400) proves the boundary is doing its job.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts