[RFC] Default to unknown=EXCLUDE?

Question raised in #480.

unknown=RAISE may be a nice default in marshmallow but it can be cumbersome to change in webargs.

In practice it is mostly useful in body payload.

I wouldn’t use it in query args, for instance, because by construction of the framewok, there may be several layers of decorators adding different fields to parse.

In flask-smorest, I added a doc section to explain it but it is still surprising for the user (see https://github.com/marshmallow-code/flask-smorest/issues/145).

While the base schema is the way to go in marshmallow and is convenient once you are familiar with this logic, it is not practical to with arguments defined with dict2schema.

I guess in practice, dict2schema is used mostly for arguments with a few fields (typically query args) while the schema form is adapted to huge schemas (typically json body). Using EXCLUDE as default would make the dict2field form work while the user could easily opt-in to RAISE when using the schema form.

Should we change the default to EXCLUDE in a major release and let the user opt-in to RAISE?

[sirosen]

This is done in dev and will be part of the 7.0.0 release. It’s available in the current beta.

For anyone reading this thread: we went with a per-location approach after all. Parsers have DEFAULT_UNKNOWN_BY_LOCATION with per-location defaults. You can read about it in the changelog or this new section of the advanced usage docs.

[sirosen]

I think the simplest solution is to just add unknown=None (as the default) to Parser.parse, and then pass any non-None value when we do the schema load.

https://github.com/marshmallow-code/webargs/blob/68f8d83b128b199e6795583d5c4bc279a64d0cb1/src/webargs/core.py#L260

becomes

load_kwargs = {}
if unknown is not None:
    load_kwargs["unknown"] = unknown
result = schema.load(location_data, **load_kwargs)

With no change in defaults for dict2schema.

That solves it because you can specify unknown and we don’t have to worry about what kind of schema was used. It’s only important for dict2schema, but it would work fine for full schemas as well.

If webargs itself adds a default for unknown in dict2schema built-in, that’s fine – we could default to EXCLUDE and I’d be okay with that – but I think we then need to be able to specify non-default values somehow. I think the above might be the best way to do it because it’s easy on us (to maintain) and provides a pretty good experience for developers.

---

I keep on thinking up “clever” ideas, like having a location_to_default_unknown_value_map to tell us headers => EXCLUDE, body => RAISE, .... But then we run into trouble trying to make a nice interface for applying any fancy logic like that. I’d rather just skip it and make dict2schema always do the same thing and let users pass unknown in their parse and use_args calls.