support: how to set correct content type in generated oas3
See original GitHub issueEndpoint returning text/plain
has a corresponding tsoa generated oas3 content
set as application/json
.
Is there any way to have a accurate content
in generated swagger.json
?
Sorting
-
I’m submitting a …
- bug report
- feature request
- support request
-
I confirm that I
- used the search to make sure that a similar issue hasn’t already been submit
Expected Behavior
"200": {
"description": "Ok",
"content": {
- "application/json": {
+ "text/plain": {
"schema": {
- "type": "number",
- "enum": [
- null
- ],
- "nullable": true
+ "type": "string"
}
}
}
Current Behavior
}
+ },
+ "/.well-known/security.txt": {
+ "get": {
+ "operationId": "GetSecurityTxt",
+ "responses": {
+ "200": {
+ "description": "Ok",
+ "content": {
+ "application/json": {
+ "schema": {
+ "type": "number",
+ "enum": [
+ null
+ ],
+ "nullable": true
+ }
+ }
+ }
+ }
+ },
+ "security": [],
+ "parameters": []
+ }
}
Possible Solution
No idea
Steps to Reproduce
--- /dev/null
+++ b/src/well-known/wellKnownController.ts
@@ -0,0 +1,16 @@
+import { Response as ExResponse, Request as ExRequest } from 'express';
+import { Controller, Get, Request, Route } from 'tsoa';
+import { WellKnownService } from './wellKnownService';
+
+@Route('/.well-known')
+export class WellKnownController extends Controller {
+ @Get('/security.txt')
+ async getSecurityTxt(@Request() request: ExRequest): Promise<null> {
+ const securityTxt = await new WellKnownService().getSecurityTxt();
+ // eslint-disable-next-line @typescript-eslint/no-explicit-any
+ const res = (<any>request).res as ExResponse;
+ res.type('.txt');
+ res.send(securityTxt);
+ return null;
+ }
+}
Context (Environment)
Version of the library: 3.14.0
Version of NodeJS: v14.17.6
- Confirm you were using yarn not npm:
- I confirm
Detailed Description
use case 1 As a security researcher I must know how to securely disclose security vulnerabilities
use case 2 as a developer that’s creating JSON REST API I wan’t to serve security.txt
as specified in https://securitytxt.org/ and mentioned in https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html#finding-contact-details
specification of security.txt
says this:
The security.txt file should have an Internet Media Type of text/plain and must be served over HTTPS.
Issue Analytics
- State:
- Created 2 years ago
- Comments:6 (4 by maintainers)
Top GitHub Comments
reopened since I’m preparing a PR that solves this
thanks @WoH - closing this one to avoid duplicates