google-cloud-platformgoogle-cloud-functionsopenapigoogle-cloud-api-gateway

Does gcp api gateway validate request body against OpenAPI spec before calling x-google-backend?


Google doesn't appear to be validating my request body schema or even that the request has a body when I use postman. Am I missing something? To me it's implied that google validates this sort of thing before calling the x-google-backend, but it always passes the request through to my cloud function, regardless if I pass valid data.

I'm using this question here as a guide.

/users:
    post:
      summary: Creates a new user.
      operationId: createUser
      consumes:
        - application/json
      parameters:
        - in: body
          name: body
          description: The user to create.
          required: true
          schema:
            $ref: './schemas/user.yaml'
      x-google-backend:
        address: https://us-central1-blablabla.cloudfunctions.net/blabla
      responses:
        201:
          description: Created

user.yaml:

type: object
required:
- username
- password
- repeatPassword
- email
properties:
  username:
    type: string
    minLength: 3
    maxLength: 50
  password:
    type: string
    minLength: 6
    maxLength: 64
  repeatPassword:
    type: string
    minLength: 6
    maxLength: 64
  email:
    type: string
    minLength: 3
    maxLength: 50

Solution

  • As of the moment, there are some limitation when using OpenAPI. There are some scopes that are being ignored by either Extensible Service Proxy (ESP) or Cloud Endpoints Framework.

    First is required parameter. Endpoints accepts OpenAPI documents that include required parameter and type definitions, but this is not required by ESP and just forwards incoming requests to your API.

    Last is external type references. Endpoints doesn't support references to type outside OpenAPI, meaning, $ref: './schemas/user.yaml' will be ignored by endpoints.

    Please be advised that you use the same OpenAPI syntax for the API Gateway as you used for Cloud Endpoints, these links also refer to locations in the Cloud Endpoints documentation.

    Here's a guide for OpenAPI feature limitations. It also includes other scopes, parameters, schemas and types being ignored by OpenAPI.

    I would also suggest to file a feature request. In this way, these features will be available in the future and will be implemeted to these types of projects.