Description
OpenAPI 2.0 file parameters require a form-compatible consumes value. The specification permits multipart/form-data and application/x-www-form-urlencoded; typical file uploads use multipart/form-data.
Potential impact
Clients may construct requests with the wrong content type, causing file uploads to fail.
Remediation
Match the effective consumes to the server’s actual upload format. An operation-level value overrides the global value. Set the file parameter’s in to formData.
Examples
These excerpts change consumes for a POST upload from application/json to multipart/form-data.
Before
json
{
"paths": {
"/": {
"post": {
"parameters": [
{
"name": "File",
"type": "file",
"in": "formData"
}
],
"consumes": [
"application/json"
]
}
}
}
}
After
json
{
"paths": {
"/": {
"post": {
"parameters": [
{
"name": "File",
"type": "file",
"in": "formData"
}
],
"consumes": [
"multipart/form-data"
]
}
}
}
}