0

我向我的 API 网关添加了一个模型。当我发送一个正文包含字符串(而不是有效的 JSON)的 POST 请求时,模型会验证该请求。我期待它被拒绝。

我已经尝试了这两种情况来显示问题:

  1. 模型将验证“A_STRING”(不正确的行为)
  2. 模型将验证“A_STRING”{}(不正确的行为)
  3. 模型将失败 {"A_STRING"} (正确的行为)

我正在直接从 AWS 控制台测试 API 网关(请参阅随附的屏幕截图),以下是一个示例的日志:

Execution log for request b2b825b4-4fb2-43e6-935b-0781264eb5df
Mon Aug 17 21:45:42 UTC 2020 : Starting execution for request: b2b825b4-4fb2-43e6-935b-0781264eb5df
Mon Aug 17 21:45:42 UTC 2020 : HTTP Method: POST, Resource Path: /TrainingNotif
Mon Aug 17 21:45:42 UTC 2020 : Method request path: {}
Mon Aug 17 21:45:42 UTC 2020 : Method request query string: {}
Mon Aug 17 21:45:42 UTC 2020 : Method request headers: {}
Mon Aug 17 21:45:42 UTC 2020 : Method request body before transformations: "A_STRING"
Mon Aug 17 21:45:42 UTC 2020 : Request validation succeeded for content type application/json

如果它有帮助,这是我的模型:

{
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-04/schema#",
  "required": 
  [
    "trainingSiteRequester",
    "employeeTrainingList"
  ],
  "properties": 
  {
    "trainingSiteRequester": 
    {
      "type": "string"
    },
    "employeeTrainingList": 
    {
      "type": "array",
      "items": 
      {
        "additionalProperties": false,
        "type": "object",
        "required": 
        [
          "id",
          "trainingURL",
          "dueDate"
        ],
        "properties": 
        {
          "trainingURL": 
          {
            "type": "string"
          },
          "dueDate": 
          {
            "type": "string"
          },
          "id": 
          {
            "type": "integer"
          }
        }
      }
    }
  }
}

在这里要完整的是我的 CloudFormation 代码,用于将模型附加到 API Gateay:

PostMethod:
  Type: AWS::ApiGateway::Method
  Properties:
    AuthorizationType: AWS_IAM
    HttpMethod: POST
    RequestValidatorId: !Ref TrainingNotificationRequestValidator
    RequestModels:
      application/json: !Ref TrainingNotificationRequestModel
    Integration:
      Credentials: !GetAtt TrainingNotificationsAPIGatewayRole.Arn
      IntegrationHttpMethod: POST
      IntegrationResponses:
        - SelectionPattern: 200
          StatusCode: 200
        - SelectionPattern: 429
          StatusCode: 429
      PassthroughBehavior: NEVER
      RequestParameters:
        integration.request.querystring.Action: "'SendMessage'"
        integration.request.querystring.TopicArn: !Sub "'${ReceivedRequestsSNS}'"
        integration.request.querystring.Message: "method.request.body"
      RequestTemplates:
        application/json: "{\"statusCode\": 200}"
      Type: AWS
      Uri:
        Fn::Join:
          - ""
          - - "arn:aws:apigateway:"
            - Ref: AWS::Region
            - ":sns:action/Publish"
    MethodResponses:
      - StatusCode: 200
      - StatusCode: 429
      - StatusCode: 500
    ResourceId: !Ref TrainingNotificationsAPIGatewayResources
    RestApiId: !Ref TrainingNotificationsAPIGateway

# Request Model
TrainingNotificationRequestModel:
  Type: AWS::ApiGateway::Model
  Properties:
    RestApiId: !Ref TrainingNotificationsAPIGateway
    ContentType: application/json
    Name: TrainingNotificationRequestModel
    Schema:
      $schema: 'http://json-schema.org/draft-04/schema#'
      additionalProperties: false
      required:
        - trainingSiteRequester
        - employeeTrainingList
      properties:
        trainingSiteRequester:
          type: string
        employeeTrainingList:
          type: array
          items:
            type: object
            additionalProperties: false
            properties:
              id:
                type: integer
              trainingURL:
                type: string
              dueDate:
                type: string
            required:
              - id
              - trainingURL
              - dueDate

TrainingNotificationRequestValidator:
  Type: AWS::ApiGateway::RequestValidator
  Properties:
    RestApiId: !Ref TrainingNotificationsAPIGateway
    Name: TrainingNotificationRequestValidator
    ValidateRequestBody: true

在此处输入图像描述

4

1 回答 1

0

找到了答案,模型的架构没有 Type 属性。

添加 type : object 使模型拒绝任何不是 json 的内容(如预期的那样),并使模型针对任何 JSON 内容运行验证。

老实说,我通过反复试验发现了这一点,所以我不能 100% 确定我的答案的原因,但它确实有效。

于 2020-08-18T02:26:10.750 回答