*/* in Accept header is ignored if not listed as the first item

[jmartisk]

Describe the bug

see #30759 (reply in thread) for description of the bug

Expected behavior

An */* type is always recognized if present in an Accept header of GraphQL requests, and the request be handled normally with the default response content type (which is application/graphql+json)

Actual behavior

An */* type is recognized only if it's the first item in the Accept header, else the GraphQL endpoint returns a 406 Unacceptable response.

How to Reproduce?

No response

Output of uname -a or ver

No response

Output of java -version

No response

GraalVM version (if different from Java)

No response

Quarkus version or git rev

No response

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

No response

[Bazalii]

@jmartisk Am I right that the problem is here?

The getRequestAccept is called and after that is called the isValidAcceptRequest. If the result of isValidAcceptRequest is not true 406 response code is returned.

The first loop checks if application/json or application/graphql+json are present in Accept header and if they are not, the function only checks for the beginning of this header. If the beginning is not */* (as in my discussion) it just returns whole header. After that this header is just checked again with isValidAcceptRequest method, which obviously returns false and 406 is returned.

These snippets are from this class

To my mind, logic of isValidAcceptRequest and getRequestAccept is a little bit strange. Isn't it better to include */* to isValidAcceptRequest so that it return true if one of the MIMEHeaders is */*?

And the piece of code that is after for loop could be simplified in this case. Instead of doing this:

String accept = ctx.request().getHeader("Accept");
if (accept != null && !accept.isEmpty() && !accept.startsWith("*/*")) {
    return accept;
}

We can just return accept. So this means that there are no application/json or application/graphql+json or */* types present in these header. So, the 406 response code should be returned.

[Bazalii]

If my thoughts are correct, I would like to contribute to solve this problem

[jmartisk]

You're quite correct, just to clarify: I'd say that when there's an */* present (anywhere) in the header, then the getRequestAccept method should return the DEFAULT_RESPONSE_CONTENT_TYPE constant. It should not return */* directly, because that would then be set as the value of Content-Type in the response, and that's wrong. So just adding */* into isValidAcceptRequest won't help, because you need to map that value into DEFAULT_RESPONSE_CONTENT_TYPE when you find it.

[Bazalii]

@jmartisk Could you please have a look at #30839?