AWS API网关(REST)-即使存在未知属性，请求验证也会通过

Question

我有一个API网关，具有以下模式：

{
"swagger": "2.0",
"info": {
"description": "This is a sample server Petstore server.  You can find out more about     Swagger at [http://swagger.io](http://swagger.io) or on [irc.freenode.net, #swagger](http://swagger.io/irc/).      For this sample, you can use the api key `special-key` to test the authorization     filters.",
"version": "1.0.0",
"title": "Swagger Petstore",
"termsOfService": "http://swagger.io/terms/",
"contact": {
"email": "[e-mail]"
},
"license": {
"name": "Apache 2.0",
"url": "http://www.apache.org/licenses/LICENSE-2.0.html"
}
},
"paths": {
"/pet": {
"post": {
"summary": "Add a new pet to the store",
"description": "",
"operationId": "addPet",
"consumes": [
"application/json",
"application/xml"
],
"produces": [
"application/xml",
"application/json"
],
"parameters": [
{
"in": "body",
"name": "body",
"description": "Pet object that needs to be added to the store",
"required": true,
"schema": {
"$ref": "#/definitions/Pet"
}
}
],
"responses": {
"405": {
"description": "Invalid input"
}
}}
}},
"definitions": {
"Pet": {
"required": ["id", "name"],
"type": "object",
"properties": {
"id": {
"type": "integer",
"description": "Id of the pet",
"example": 123
},
"name": {
"type": "string",
"description": "Name of the pet",
"example": "Jammy"
},
"nickname": {
"type": "string",
"description": "Nickname of the pet",
"example": "Jam"
}
}
}

}
}

当我发送带有模式中不存在的字段的请求主体时，我不会从API网关得到400响应。我已经将配置应用于验证正文、标头、查询字符串。

这是API网关中的一个公开问题吗？还是我错过了什么？

Answer 1

因此，对于swagger v2和openapiv3规范，默认行为是接受规范未定义的所有其他属性。如果你包含了所需的宠物id和名称以及其他未使用的属性，如foo和bar，你的帖子应该会成功。

如果你想要更严格的验证，但在发送额外属性时失败，那么在你的宠物模式中将additionalProperties设置为false，或者这样做，并将规范版本更改为3.x.x