Description
In an OpenAPI 3.0 object schema, omitting additionalProperties or setting it to true permits undefined properties. This may allow more than the API contract intends when the object should contain only defined fields.
Potential impact
Unexpected behavior may result if the server stores or processes unintended request fields. Undocumented response fields may also cause clients to interpret the data differently.
Remediation
Use additionalProperties: false when only defined fields are allowed, and enforce it in validation. If an object needs dynamic keys, allow additional properties and define a schema for their values where needed.
Examples
This OpenAPI 3.0 response-schema excerpt changes the object to reject fields other than id and name. It does not make those two fields required.
Before
json
{
"openapi": "3.0.0",
"paths": {
"/": {
"get": {
"responses": {
"200": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"id": { "type": "string" },
"name": { "type": "string" }
},
"additionalProperties": true
}
}
}
}
}
}
}
}
}
After
json
{
"openapi": "3.0.0",
"paths": {
"/": {
"get": {
"responses": {
"200": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"id": { "type": "string" },
"name": { "type": "string" }
},
"additionalProperties": false
}
}
}
}
}
}
}
}
}