`ERROR: DELETE operations cannot have a requestBody` contradicts RFC 7231 Section 4.3.5

Q&A (please complete the following information)

• OS: maxOS
• Browser: chrome
• Version: 71
• Method of installation: https://editor.swagger.io/
• Swagger-Editor version: unclear (would be nice if the version was shown on the UI
• Swagger/OpenAPI version: OpenAPI 3.0

Content & configuration

openapi: 3.0.2  
info:
  title: I can haz delete with request body
  version: 1.x
paths:
  /test:
    delete:
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object 
      responses:
        '204':
          description: No Content

Describe the bug you’re encountering

RFC 7231 Section 4.3.5 states:

A payload within a DELETE request message has no defined semantics; sending a payload body on a DELETE request might cause some existing implementations to reject the request.

In other words, a DELETE request may have a request body, it is up to the server to define the semantics.

Given that OpenAPI is specifically designed to specify semantics, we should not get an error message such as this:

Semantic error at paths./test.delete.requestBody
DELETE operations cannot have a requestBody.

To reproduce…

Steps to reproduce the behavior:

1. Go to https://editor.swagger.io/
2. Replace the editor content with the sample yaml above

Expected behavior

It shall not be an error for a DELETE request to define the semantics with respect to request bodies.

Screenshots

Additional context or thoughts

From looking at the HTTP 1.1. spec, the only request type that is forbidden from having a request body is TRACE

A client MUST NOT send a message body in a TRACE request.

Thus if the spec authors wanted to exclude request bodies from DELETE requests they would have included a MUST NOT in the DELETE section, but they didn’t therefore request bodies are allowed

[n2ygk]

Your bug is my feature

On Mon, Apr 22, 2019 at 5:21 PM Brett Randall [e-mail] wrote:

@n2ygk https://github.com/n2ygk

RFC 7231 does not explicitly disallow DELETE with request body – It just says the semantics are undefined

Correct - and the OpenAPI specification says https://swagger.io/specification/#operationRequestBody:

The requestBody is only supported in HTTP methods where the HTTP 1.1 specification RFC7231 has explicitly defined semantics for request bodies. In other cases where the HTTP spec is vague, requestBody SHALL be ignored by consumers.

So I think the request body should be ignored here. Are you saying that try-it-out not only sent the request, but processed the DELETE request body? That should be a bug.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/swagger-api/swagger-editor/issues/1929#issuecomment-485557123, or mute the thread https://github.com/notifications/unsubscribe-auth/ABBHS55BMLFKDBLJMWVATULPRYT7HANCNFSM4GO45EJQ .

[n2ygk]

@n2ygk

Your bug is my feature

The bug is that the {json:api} people decided to ignore the guidance of RFC 7231 and exploit an intentionally undefined area in a non-standard way. I’d file a bug on their spec, although I doubt they will be receptive given the attitude towards the RFC on display in their docs.

@handrews One might argue that ember data and jsonapi.org history predates RFC 7231. I’m not sure Yehuda Katz intentionally ignored guidance that hadn’t been given yet. The guidance was not present in the then-current RFC 2616 and the {json:api} DELETE method is idempotent. (The “no body rule” first appeared in draft 14, April 2011, well after SproutCore 2.0 which became Ember.js had been developed).

Just sayin’ that perhaps DELETE with a request body is a bad idea but I wouldn’t take the leap and say people intentionally ignored guidance.