If a Content-Type header is set, it is used for validation and then removed, because it additionally exists in the http.content.headers attribute.

Author: Chris Wiechmann

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [1.6.2] 2022-06-30
+### Fixed
+- If a Content-Type header is set, it is used for validation and then removed, because it additionally exists in the http.content.headers attribute.
+
 ## [1.6.1] 2022-06-27
 ### Fixed
 - Added call to removeDuplicateContentTypeHeader when return header to validator

pom.xml

@@ -3,7 +3,7 @@
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.github.axway-api-management-plus.openapi-validator</groupId>
    <artifactId>openapi-validator</artifactId>
-   <version>1.7.0</version>
+   <version>1.6.2-SNAPSHOT</version>
    <name>openapi-validator</name>
 
    <url>https://github.com/Axway-API-Management-Plus/openapi-validator</url>

src/main/java/com/axway/apim/openapi/validator/OpenAPIValidator.java

@@ -245,7 +245,6 @@ public Map<String, Collection<String>> getHeaders() {
 
 			@Override
 			public Collection<String> getHeaderValues(String name) {
-				Utils.removeDuplicateContentTypeHeader(headers);
 				return Utils.getHeaderValues(headers, name);
 			}
 		};
@@ -256,6 +255,8 @@ public Collection<String> getHeaderValues(String name) {
     			Utils.traceMessage(message.getMessage(), TraceLevel.valueOf(message.getLevel().name()));
     		}
     	}
+    	// Finally remove the Content-Type header if exists, as it exists additionally in http.content.headers
+    	Utils.removeContentTypeHeader(headers);
     	return validationReport;
     }
 

src/main/java/com/axway/apim/openapi/validator/Utils.java

@@ -89,7 +89,7 @@ public static Collection<String> getHeaderValues(HeaderSet headers, String name)
 			// Check if the requested header was the content-type header which we default to application/json
 			if(name.toLowerCase().equals("content-type")) {
 				// For any reason, sometimes the API-Gateway at runtime removes the Content-Type header from the attribute http.headers
-				traceMessage("WARN - Header: Content-Type not found. Defaulting to application/json.", TraceLevel.DEBUG);
+				traceMessage("WARN - Header: Content-Type not found. Default to application/json.", TraceLevel.DEBUG);
 				result.add("application/json");
 				return result;
 			} else {
@@ -106,18 +106,19 @@ public static Collection<String> getHeaderValues(HeaderSet headers, String name)
     }
 
     /**
-     * @param headers that might contain a duplicated Content-Type header
+     * The content type may have been merged into http.headers by the policy scripting filter, 
+     * but additionally exists in http.content.headers. 
+     * This leads to a duplication of the Content-Type header in the backend request, 
+     * because the API gateway appends the http.content.header additionally. 
+     * Therefore, the Content-Type header is removed here again after it was 
+     * used for validation.
+     * @param headers that might contain the Content-Type header
      */
-    public static void removeDuplicateContentTypeHeader(HeaderSet headers) {
+    public static void removeContentTypeHeader(HeaderSet headers) {
     	HeaderEntry contentTypeHeader = headers.getHeaderEntry("Content-Type");
-    	if(contentTypeHeader != null && contentTypeHeader.size()>1) {
-    		traceMessage("WARN - Header: Multiple Content-Type headers found. Remove all but the first header.", TraceLevel.DEBUG);
-    		// Get the first header
-    		Header first = contentTypeHeader.get(0);
-    		// Clear all others
-    		contentTypeHeader.clear();
-    		// Add only one header
-    		contentTypeHeader.add(first);
+    	if(contentTypeHeader != null) {
+    		traceMessage("INFO - Remove Content-Type header as it exists in the http.content.headers attribute and this would result in a duplicate.", TraceLevel.DEBUG);
+    		headers.remove("Content-Type");
     	}
     	return;
     }

src/test/java/com/axway/apim/openapi/validator/UtilsTest.java

@@ -32,8 +32,7 @@ public void testRemoveDuplicateContentTypeHeader() throws IOException {
     	headers.addHeader("content-Type", "application/json");
     	headers.addHeader("Content-type", "application/xml");
     	Assert.assertEquals(headers.getHeadersSize("Content-Type"), 2);
-    	Utils.removeDuplicateContentTypeHeader(headers);
-    	Assert.assertEquals(headers.getHeadersSize("Content-Type"), 1);
-    	Assert.assertEquals(headers.getHeader("Content-Type"), "application/json");
+    	Utils.removeContentTypeHeader(headers);
+    	Assert.assertNull(headers.getHeaderEntry("Content-Type"), "The content-Type header should have been removed, because it's managed separately by http.content.headers.");
 	}
 }