mirror of
https://github.com/jupyterhub/jupyterhub.git
synced 2025-10-17 15:03:02 +00:00
Validate Content-Type Header for api/users
The content-type of Hub API requests used for user management, specifically for creating a user is not validated and so the ‘text/plain’ type is accepted, where it must be ‘application/json’. This commit adds validation for `Content-type` header for the /hub/api/users endpoint to only allow requests with content-type as `application/json`
This commit is contained in:
@@ -409,6 +409,10 @@ async def test_add_multi_user_bad(app):
|
||||
assert r.status_code == 400
|
||||
r = await api_request(app, 'users', method='post', data='[]')
|
||||
assert r.status_code == 400
|
||||
r = await api_request(
|
||||
app, 'users', method='post', data='{}', headers={"Content-Type": "text/plain"}
|
||||
)
|
||||
assert r.status_code == 403
|
||||
|
||||
|
||||
@mark.user
|
||||
|
Reference in New Issue
Block a user