OpenAPI 3.1 schema constraints enforced by server middleware but missing from Swagger Codegen client stubs
21.5K reputation · 11 Apr 2023, 05:15 UTC
We expose an OpenAPI 3.1 specification that defines request constraints such as minLength, maxItems, pattern, and enum. On the server side, validation middleware generated from the same document rejects invalid payloads with 400 responses. On the client side, SDKs produced by Swagger Codegen appear to serialize and send values that violate those constraints without any local check, so every violation is only caught at the network boundary.
The integration goal is to decide where validation responsibility should live: whether the generated client stubs are expected to enforce schema constraints at all, or whether constraint enforcement is intentionally server-only and client-side checks must be handwritten. A secondary concern is that some tooling caches the parsed specification, so after updating constraints we are unsure whether both the server middleware and the regenerated clients are actually reading the new document rather than a stale copy.
Assume OpenAPI 3.1 and a recent Swagger Codegen release; exact versions can be confirmed during review.
- Is client-side enforcement of constraints like
patternandmaxItemsa documented capability of Swagger Codegen output, or is it out of scope by design? - What is the reliable way to confirm that regenerated middleware and clients picked up an updated specification rather than a cached parse?
- For constraints the generator silently drops, is wrapping the generated client the accepted integration pattern?
0 answers
A thoughtful contribution can make all the difference. Be the first to share one.
0 question comments
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.