Fastify schema validation isn't working. Do I have something configured the wrong way?

Question

I'm trying to figure out why the schema validation is not working in Fastify. I have the following code:

const postOptions = {
        schema: { 
            body: {
                type: 'object',
                properties: {
                    name: { type: 'string' },
                    parentId: { type: 'number' },
                    requiredKey: { foo: { type: 'string'} }
                }
            },
            response: {
                201: {
                    type: 'object',
                    properties: {
                        id: { type: 'number'},
                        name: { type: 'string'},
                        parentId: { type: 'number' }
                    }
                }
            }
        }
    }
    fastify.post('/sponsor', postOptions, async (request, reply) => {

        console.log(`POST /sponsor called`)

        return { id: 2, name: 'Zenotis', parentId: 1 }
    })

When I use postman to test it out, I can send any keys and values with the body and it goes through fine. It seems like it's not checking at all. Same thing with response. I'm using Fastify version 2.11.0

Edit: here is the json body I'm sending:

{
  "name": "Test",
  "parentId": 5555555,
  "foo": "bar"
}

Here's what I would expect to fail:

{
  "myName": "the field is not name",
  "parentID": "The D is capitalized and this is a string",
  "bar": "where did this field come from, it's not foo"
}

If I send this body, it goes through fine. How do I configure it to fail in all these cases?

Answer 1

Your schema use has a few fixes to apply:

• if you don't set the status code 201, the response schema you set will not work. Use '2xx' or set the right code in the reply object
• to remove the field that are not in the schema you need to add additionalProperties
• if you don't set the required field in the schema, all the fields are optionals

Here a blocking example:

const fastify = require('fastify')()
const postOptions = {
  schema: {
    body: {
      type: 'object',
      additionalProperties: false, // it will remove all the field that is NOT in the JSON schema
      required: [
        'name',
        'parentId',
        'requiredKey'
      ],
      properties: {
        name: { type: 'string' },
        parentId: { type: 'number' },
        requiredKey: { foo: { type: 'string' } }
      }
    },
    response: {
      201: {
        type: 'object',
        properties: {
          id: { type: 'number' },
          name: { type: 'string' },
          parentId: { type: 'number' }
        }
      }
    }
  }
}
fastify.post('/sponsor', postOptions, async (request, reply) => {
  console.log('POST /sponsor called')
  reply.code(201) // if you don't set the code 201, the response schema you set will not work
  return request.body
})

fastify.inject({
  method: 'POST',
  url: '/sponsor',
  payload: {
    name: 'Test',
    parentId: 5555555,
    foo: 'bar'
  }
}, (_, res) => {
  console.log(res.json())
    /* it will print
    {
      statusCode: 400,
      error: 'Bad Request',
      message: "body should have required property 'requiredKey'"
    }
    */

})