seeing a very strange behavior in ktor ```route("/...

# ktor

[Fred Friis]

seeing a very strange behavior in ktor

route("/v1/interactions/taps") {
         post {
               val req = call.receive<AddTapRequest>()

where

data class AddTapRequest(val recipientId: Long, val tapType: Int)

if called with

POST v1/interactions/taps { "tapType":1 }

ie no recipient (it's a required attribute)

rather than failing the request, Ktor just pretends like the caller sent recipientId 0

[Trevor Stone]

How is your json instance configured

[Fred Friis]

thanks for the reply, not sure what you mean by "json instance"? are you referring to if the server has content negotiation and if so what it's configured with?

[Trevor Stone]

yes

[Fred Friis]

install(ContentNegotiation) {
         fooJackson()
      }

where

fun Configuration.fooJackson(block: ObjectMapper.() -> Unit = {}) {
   jackson {
      standardFooJacksonMapperConfig()
      block()
   }
}

fun ObjectMapper.standardFooJacksonMapperConfig() {
   configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
   configure(DeserializationFeature.READ_DATE_TIMESTAMPS_AS_NANOSECONDS, false)
   configure(DeserializationFeature.READ_UNKNOWN_ENUM_VALUES_USING_DEFAULT_VALUE, true)
   configure(SerializationFeature.WRITE_DATE_TIMESTAMPS_AS_NANOSECONDS, false)
   configure(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS, true)
   configure(SerializationFeature.WRITE_ENUMS_USING_INDEX, false)
   registerModule(JavaTimeModule())
}

[Ivan Pavlov]

You need to enable this one for it to fail https://fasterxml.github.io/jackson-databind/javadoc/2.6/com/fasterxml/jackson/databind/DeserializationFeature.html#FAIL_ON_MISSING_CREATOR_PROPERTIES

[Fred Friis]

is it us who have disabled that or is that off by default?

because it seems odd that ktor out of the box would not blow up on incomplete requests

[Trevor Stone]

Ktor is "just" delegating to the serialization library you're using

[Trevor Stone]

without it Ktor doesn't even know what json is

[Fred Friis]

mm I'll have to spin up a fresh jackson ktor server and see what the default is

highly doubt it allows requests like this out the box, smells to me like something we've borked

but if jackson does allow such requests through out of the box, that's arguably insane

[Fred Friis]

i mean certainly me personally i'd expect incomplete requests to fail by default, not the other way around lol

[Trevor Stone]

In the linked docs "Feature is disabled by default, so that no exception is thrown for missing creator property values, unless they are explicitly marked as required."

[Trevor Stone]

But I haven't used Jackson before

[Trevor Stone]

https://fasterxml.github.io/jackson-annotations/javadoc/2.8/com/fasterxml/jackson/annotation/JsonProperty.html#required() shows that Jackson defaults required to false

[Fred Friis]

🤦

[Trevor Stone]

So you also could annotate the property with JsonProperty and mark as required

[Fred Friis]

yeah looks like that's what's needed if it's not enabled by default

[Fred Friis]

thanks everyone, much appreciate the replies

[Trevor Stone]

I've been using kotlinx serialization and it's been working well without too many footguns

[Trevor Stone]

Like your expectation about the fields being required, Jackson is a Java library/codebase so non-nullable types isn't a thing

[Fred Friis]

I'm pretty sure if you use DropWizard + Jackson in Java it does fail incomplete requests

but that might be because DropWizard have configured it sanely out of the box than, rather than Jackson working as expected out of the box

[Trevor Stone]

I've never used DropWizard but looking at it briefly it seems like an opinionated framework. Ktor is very much non-opinionated and tries to delegate as much as it can to other libraries. There are tradeoffs between them for sure, but from my experience Ktor tried to minimize its footprint in the project using it

[Trevor Stone]

From dropwizard docs: "Jersey maps the request entity to any single, unbound parameter. In this case, because the resource is annotated with @Consumes(MediaType.APPLICATION_JSON), it uses the Dropwizard-provided Jackson support which, in addition to parsing the JSON and mapping it to an instance of Notification, also runs that instance through Dropwizard’s Constraining Entities."

[Trevor Stone]

So they are using the @NonNull annotation that kotlin exposes to java callers

[Fred Friis]

by all means I do prefer lighter weight frameworks like Ktor

the further away from Spring the better basically lol