Accessing the Request Body in Plug

Questions / Help
1

I have a question about getting consistent access to the Request Body in Plug.

According to the documentation for Plug.Conn.read_body the body is consumed once it is accessed.

If you need to access the body multiple times, it is your responsibility to store it. Finally keep in mind some plugs like Plug.Parsers may read the body, so the body may be unavailable after being accessed by such plugs.

I’m trying to figure out a good way to build a Plug that plays nicely in an ecosystem where downstream code relies on Plug.Parsers handling JSON but some routes need to verify a signature on the raw request body? Is this possible at all or do I need to put a service in front of everything to block unsigned requests to the protected endpoints?

2

It’s not that hard to add your own plug in the pipeline first which reads the body and stashes a copy (or reads it and validates a signature). Sorry I don’t have access anymore to my code that does that.

3

Do you really need to rely on Plug.Parser to handle the JSON for you… or could your verification plug read the body and put the JSON into the Conn in the same place that Plug.Parsers does (so it takes up the responsibility of validating what it needs to AND parsing the JSON)?

2 Likes
4

https://hexdocs.pm/plug/Plug.Parsers.html#module-custom-body-reader

4 Likes
5

Ha, I was in the wrong part of the docs, thanks.

6

This was a really useful post for me, thank you!