400 Bad Request: XML Validation Failed

Membrane API Gateway rejects a message with the title XML message validation failed when the validator plugin finds that the XML body does not validate against the XML Schema. If the request is invalid, the client is to blame. If the backend response is invalid, the backend is to blame.

The Error Response

The response contains the title XML message validation failed, a validation field that lists the errors, the problem type https://membrane-api.io/problems/user/validation and a link to this page. The type user/validation means that a message did not pass validation. The status depends on the direction:

In production mode, a 500 has the title Internal Server Error and the shortened type https://membrane-api.io/problems/user.

How the validator Plugin Works

The validator checks the body of a message against a schema. Placed in the request flow, it validates requests. Placed in the response flow, it validates backend responses. With schema, it validates XML against an XML Schema:

api:
  port: 2000
  flow:
    - request:
        - validator:
            schema: order.xsd
  target:
    url: https://api.predic8.de

api:
  port: 2000
  flow:
    - request:
        - validator:
            schema: order.xsd
  target:
    url: https://api.predic8.de

A validator with wsdl answers with a SOAP fault, and one with schematron with an XML error document, instead of this response. For JSON, see JSON validation failed.

Common Causes

The Body Violates the Schema

The body contains an unexpected element, uses the wrong namespace, misses a required element or has an invalid value. The validation field lists the errors.

The Body Is Not Well-Formed XML

The body has a syntax error, such as an unclosed tag, or is not XML at all. This is reported as a validation error, too.

The Body Contains a DOCTYPE

For protection against XML attacks, the parser used for validation rejects documents with a DOCTYPE declaration.

The Schema Cannot Be Loaded

Running the schema fails, for example because an imported or included schema cannot be resolved. This is also reported as a validation error, and the log shows the failure.

The Backend Returns an Invalid Response

With the validator in the response flow, the backend returns a body that does not match the schema, for example after a change in the backend that was not reflected in the schema.

How to Fix It

1. Read the validation field of the response. It names the violated constraints.
2. For request errors (400), correct the message in the client.
3. For response errors (500), fix the backend, or correct the schema if the response is right. If the log shows schema resolution errors, fix the schema location or its imports.

To log validation failures in addition to rejecting them, set failureHandler: log on the validator.

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem. In production mode, the link to this page is left out:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---. The list of errors in the validation field is still sent in production mode, because the schema is considered public. To reject messages without listing the errors, set validationDetails: false:

api:
  port: 2000
  flow:
    - request:
        - validator:
            schema: order.xsd
            validationDetails: false
  target:
    url: https://api.predic8.de

api:
  port: 2000
  flow:
    - request:
        - validator:
            schema: order.xsd
            validationDetails: false
  target:
    url: https://api.predic8.de

Related Documentation

Configuration reference:

• validator

Tutorials with runnable examples:

• XSD Schema validation
• WSDL Message Validation

← All Membrane error messages