Repository navigation
fix(resolver): keep HTTP status when copying guarded responses - #4308
Open
robert-hebel-sb wants to merge 1 commit into
Open
robert-hebel-sb wants to merge 1 commit into
robert-hebel-sb wants to merge 1 commit into
Conversation
Browsers return fetch responses whose headers can't be mutated, so the ApiDOM HTTP resolver copies the response to remove its Content-Type. The copy spread the response into the Response init, but status, statusText and url are getters of Response.prototype, so every external document retrieved in a browser became a 200 OK: a 404 page was parsed as the referenced document and no resolver error was reported. This affects every ApiDOM-based strategy (OpenAPI 3.1 and 3.2). Copy status and statusText explicitly and keep the response URL as an own property of the copy, which the Response constructor can't set, so responseInterceptor sees the same response as in Node.js. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In browsers,
fetchreturns responses whose headers can't be mutated. The ApiDOM HTTP resolver (HTTPResolverSwaggerClient) therefore copies the response to remove itsContent-Type. The copy spread the response into theResponseinit, butstatus,statusTextandurlare getters ofResponse.prototype, so the spread copied none of them.As a result, every external document retrieved in a browser became a
200 OK. A 404 page was parsed as the referenced document, and no resolver error was reported. In Node.js, undici lets the headers be mutated, so the bug only shows in browsers. It affects every ApiDOM-based strategy (OpenAPI 3.1 and 3.2).Fix: copy
statusandstatusTextexplicitly. Keep the response URL as an own property of the copy, since theResponseconstructor can't set it, soresponseInterceptorsees the same status and final URL as in Node.js.Tests: the resolver now reads guarded responses (browser-like headers): a 200, a 404 that must fail,
responseInterceptorreceiving status and URL, and an OpenAPI 3.1 external$refto a 404 that must report an error. Three of them fail on main.Found by Swagger UI while testing external
$refs in Chromium.🤖 Generated with Claude Code