diff --git a/.changeset/honest-terms-help.md b/.changeset/honest-terms-help.md new file mode 100644 index 000000000000..abd0de094d8c --- /dev/null +++ b/.changeset/honest-terms-help.md @@ -0,0 +1,5 @@ +--- +'@sveltejs/kit': patch +--- + +fix: correctly return 415 when unexpected content types are submitted to actions diff --git a/packages/kit/src/runtime/server/page/actions.js b/packages/kit/src/runtime/server/page/actions.js index 0d656815d83d..2c43d26be0a4 100644 --- a/packages/kit/src/runtime/server/page/actions.js +++ b/packages/kit/src/runtime/server/page/actions.js @@ -220,7 +220,8 @@ async function call_action(event, actions) { } if (!is_form_content_type(event.request)) { - throw new Error( + throw error( + 415, `Actions expect form-encoded data (received ${event.request.headers.get('content-type')})` ); } diff --git a/packages/kit/test/apps/basics/test/test.js b/packages/kit/test/apps/basics/test/test.js index d4b56ba50c92..59a34aae0391 100644 --- a/packages/kit/test/apps/basics/test/test.js +++ b/packages/kit/test/apps/basics/test/test.js @@ -1220,6 +1220,21 @@ test.describe('Actions', () => { await expect(page.locator('pre')).toHaveText('something went wrong'); }); + + test('submitting application/json should return http status code 415', async ({ baseURL }) => { + const response = await fetch(`${baseURL}/actions/form-errors`, { + method: 'POST', + body: JSON.stringify({ foo: 'bar' }), + headers: { + 'Content-Type': 'application/json', + Origin: `${baseURL}` + } + }); + const { type, error } = await response.json(); + expect(type).toBe('error'); + expect(error.message).toBe('Actions expect form-encoded data (received application/json)'); + expect(response.status).toBe(415); + }); }); // Run in serial to not pollute the log with (correct) cookie warnings