415 Unsupported Media Type or 400 Bad Request: Request Discarded by xmlProtection

Membrane API Gateway returns an error with the title Request discarded by xmlProtection when the xmlProtection plugin discards a request because its content is not XML, or because a multipart body or the document cannot be processed.

The Error Response

The response contains the title Request discarded by xmlProtection, a detail that describes the reason and names the affected part, the problem type https://membrane-api.io/problems/user and a link to this page. The type user means that the request caused the problem, not an internal failure of the gateway. The status depends on the case:

415 Unsupported Media Type

The request, or a part of a multipart request, is not XML.

400 Bad Request

A multipart body cannot be processed, or the document could not be read or rewritten while it was scanned.

Attacks and limit violations in the XML document itself, such as too deep nesting or too many attributes, are reported with a different problem type.

What the xmlProtection Plugin Does

The xmlProtection plugin protects backends against XML attacks. It scans XML bodies, enforces limits such as maxDepth and maxAttributeCount, and can remove the DTD. See Protection Against XML Attacks.

api:
  port: 2000
  flow:
    - xmlProtection:
        maxDepth: 50
        removeDTD: true
  target:
    url: https://api.predic8.de

api:
  port: 2000
  flow:
    - xmlProtection:
        maxDepth: 50
        removeDTD: true
  target:
    url: https://api.predic8.de

Common Causes

The Content Type Is Not XML

The request Content-Type is not an XML type, or it is missing. xmlProtection does not inspect a body without an XML Content-Type and rejects it while otherContentTypes is reject, the default. The result is 415.

A Multipart Part Is Not XML

A part of a multipart body is not XML, for example a file attachment next to an XML part, while otherContentTypes is reject. The result is 415.

The Multipart Body Cannot Be Processed

A multipart part is larger than maxSize, is itself a multipart, uses an unsupported Content-Transfer-Encoding, or the multipart structure is malformed. The result is 400.

The Document Cannot Be Rewritten

The document could not be read or rewritten while it was scanned, for example when removing the DTD, or a rewritten part cannot be put back into the multipart body safely. The result is 400.

How to Fix It

1. Read the detail. It names the reason and the affected part.
2. As a client, send XML bodies with an XML Content-Type such as application/xml or text/xml, and well-formed multipart bodies.
3. As an operator, set otherContentTypes: skip to let non-XML bodies or parts pass unchecked.
4. If legitimate parts are too large, raise maxSize. To cap the size of the whole request, use the limit plugin.

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem. These details may reveal information about your setup. In production, turn them off:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---.

Related Documentation

Configuration reference:

• xmlProtection

Tutorials with runnable examples:

• XML Protection

← All Membrane error messages