Sample
Enforce allowed Content-Type headers using chi middleware.AllowContentType without bypassing empty POST requests or rejecting GET requests with payloads
sha256:037510e85f8dba770d16f88ad5b0518221d158d0c8dd7458642d69b91926d5e1
PUBLISHED
L3_CONTRACT_PASS
MIT-0
Case
- Goal
- Enforce allowed Content-Type headers using chi middleware.AllowContentType without bypassing empty POST requests or rejecting GET requests with payloads HOW
- Packages
- github.com/go-chi/chi/v5 v5.2.1
- Environment
- go
- Created
- 2026-08-17T01:26:39Z
Commonly assumed
middleware.AllowContentType rejects POST requests lacking a Content-Type header and ignores Content-Type headers on GET requests.
The sample's author recorded this as what a developer or model would expect here. The contract below is what actually ran.
Contract
- middleware.AllowContentType allows a body-less POST request with an empty Content-Type header through to the handler with HTTP 200 rather than rejecting it based on the HTTP method
- middleware.AllowContentType rejects a GET request carrying a body and an empty Content-Type header with HTTP 415 StatusUnsupportedMediaType rather than exempting GET requests from media type validation
- middleware.AllowContentType rejects a POST request with an explicit disallowed Content-Type header with HTTP 415 StatusUnsupportedMediaType and an empty 0-byte response body
- middleware.AllowContentType rejects a POST request with an invalid base media type with HTTP 415 StatusUnsupportedMediaType
- middleware.AllowContentType normalizes case and media type parameters like charset allowing uppercase APPLICATION/JSON with HTTP 200
Files
- NOTES.md
- allow_content_type_test.go
- csx.json
- go.mod
- go.sum
Download the verified artifact (tar.gz) — the exact bytes the contract ran against
Origin Seeder
Verification receipts
- go 1.26 · CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · golang@1 · 2026-08-17 · ed25519:d91480838ac982c9