Conjur returns 500 error on empty request body

[telday]

Summary

When a request is made to Conjur with an empty body but the header Content-Type: application/json the server will attempt to parse the request body and throw an uncaught error because it is invalid JSON.

Steps to Reproduce

This is known to happen on the /host_factory_tokens endpoint using the DELETE method

1. Create a request with an empty body and the Content-Type: application/json header
2. Send the request to the server

Expected Results

The server should handle the error nicely and return a 400 to the user.

Actual Results (including error logs, if applicable)

A 500 error (and an HTML page) is returned

Reproducible

• Always
• Sometimes
• Non-Reproducible

Environment setup

Running in a docker-compose environment from the cyberark/conjur:1.9 image.

[boazmichaely]

@alexkalish is this a breaking change ?

[alexkalish]

@boazmichaely: Not sure. I'll dive in later this week when I start the release notes.

[alexkalish]

@telday: Do you know if the CLI or any of the official API clients send this content type with empty request bodies?

[telday]

@alexkalish To my knowledge neither the Ruby or Go clients create requests like this (also haven't seen it in the Ruby CLI). The reason I came across it was because the generated clients often do.