ModelSerializer requires RelatedManager field with content-type json but not with form-data

[bacheric]

Hello everyone,
I stumbled upon an interesting issue which caused me some hours of debugging to finally understand it.

I have two models (reduced in this example:

privacy_processing_activity.py

    tenant = models.ForeignKey(Tenant, on_delete=SET_NULL)

    name = models.CharField(max_length=256)

privacy_recipient_reference.py

class PrivacyRecipientReference(models.Model):
    privacy_processing_activity = models.ForeignKey(
        "PrivacyProcessingActivity", on_delete=models.CASCADE, related_name="recipient_references"
    )
    privacy_recipient = models.ForeignKey(
        "PrivacyRecipient", on_delete=models.CASCADE, related_name="recipient_references"
    )
    description = models.TextField(default="", blank=True)

Serializer:

class PrivacyProcessingActivitySerializer(serializers.ModelSerializer):
    class Meta:
        model = PrivacyProcessingActivity
        fields = [
            "id",
            "tenant",
            "name",
            "recipient_references",
        ]

Sending a POST request now with postman using Body: raw/json,

{
    "tenant": 1, 
    "name": "test_name"
}

I get a 400 return with

{
    "recipient_references": [
        "This field is required."
    ]
}

If I send it as form-data instead, the serializer has no issues and the object is created and I get a 201 response.

To me it should not make a difference in that case, but the serializer obviously behaves differently. I fixed it by creating a SerializerMethodField() in the serializer since I want my api consumers to be able to use both request types.

I found a somewhat similar sounding issue here: #5807 but I don't really know if its related.

[tomchristie]

Sounds like the difference between sending an empty string in one case, and a missing field in the other perhaps?

[bacheric]

Hey @tomchristie, thanks for your answer.
I would disagree here, the difference via sending is exactly this (postman request converted to code):

Does not work:

import requests
import json

url = "http://localhost:8000/api/v3/privacy/processingactivities/"

payload = json.dumps({
  "tenant": 1,
  "name": "Test"
})
headers = {
  'Content-Type': 'application/json',
  'Authorization': '••••••'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)

Does work:

import requests

url = "http://localhost:8000/api/v3/privacy/processingactivities/"

payload = {'tenant': '1',
'name': 'test'}
files=[

]
headers = {
  'Authorization': '••••••'
}

response = requests.request("POST", url, headers=headers, data=payload, files=files)

print(response.text)

It seems that DRFs internal parsing logic behaves differently even though the transmitted fields are the same, the only difference is that in the example that does not work when calling json.dumps() to the exact same payload before.
The only fields affected are ReverseRelations mentioned in the ModelSerializer, so I guess it is just a bit exotic and has not been spotted before, however in no way it seems like working-as-intended for me.