[@hono/zod-validator] When making a request without a Content-Type Header and Request Body, the zod schema is z.object.partial, and the zValidator will pass validation

[shinexoh]

Which middleware has the bug?

zod-validator

What version of the middleware?

0.7.3

What version of Hono are you using?

4.9.8

What runtime/platform is your app running on? (with version if possible)

Bun 1.2.22

What steps can reproduce the bug?

When I use zValidator to validate a JSON request body and set the schema to z.object({ name: z.string() }).partial(), the validation by zValidator is completely bypassed if the request is made without the Content-Type: application/json header and without a request body.

Ideally, zValidator should validate the request body. Even if the request body is an empty object {}, it should still comply with the validation rules of this schema.

This is the reproduction code.

const schema = z.object({ name: z.string() }).partial();
router.post('/test', zValidator('json', schema), (c) => {
  const body = c.req.valid('json');
  return c.text('ok');
});
// ok

I am using zod 4.1.11. I am not entirely sure if this is a bug or a feature, but it does not quite meet my expectations.

What is the expected behavior?

No response

What do you see instead?

No response

Additional information

No response

[yusukebe]

Hi @shinexoh

Does that mean "if the request without Content-Type: application/json header is not handled by zValidator('json', ...)" is a bug?

If so, it's not a but. If you set json as the first argument of zValidator(), it will only handle the request with Content-Type: application/json header. This is expected behavior; the validator validates a JSON request if the user specifies json.

[shinexoh]

Yeah, but if you remove partial() from const schema = z.object({ name: z.string() }).partial(); and then make a request to the route without the Content-Type: application/json header, the zValidator catches it and returns a validation error. That's kinda weird, because you said the zValidator only validates requests with Content-Type: application/json.

[yusukebe]

@shinexoh

I've confirmed the specs. The validation function will be executed whether it has a content type or not. The meaning of the first argument of validator, such as json or form is where to get the value; if the content type is JSON, it will get the value with c.req.json(), but it will not get the value from the form body.

This is an expected behavior which is defined in the test:

https://github.com/honojs/hono/blob/3e5a6e8ba9cd239ef81ff8214a8bf937fa2c45f9/src/validator/validator.test.ts#L619-L626

[shinexoh]

Thanks for your patient explanation, I think I roughly know when zValidator will be triggered.

I still have a question. The first parameter of zValidator is still json, and this Schema is used as the second parameter of zValidator:

const schema = z.object({ name: z.string() }).partial();

The TS type inferred using z.infer<typeof schema> is like this:

type SchemaType = z.infer<typeof schema>;
// type SchemaType = {
//   name?: string | undefined;
// };

When I request this route, I still don't carry any request headers or request body, and it can pass the validation, which makes me a little confused. Because in the defined Schema, z.object makes all attributes of the Object itself optional because partial is called, but this Object is not optional. An empty Object {} should be passed in the request body to meet the validation rules and pass the validation.

I printed out the return value of c.req.valid('json') after the validation passed, and it turned out to be an empty object {}, but I didn't make the request with any headers or request body.

[yusukebe]

As you explained, in the current implementation, if the request body is empty and there is no content type, the value to be validated will be {}. It's a default value.

[shinexoh]

This is where things get confusing. It should be undefined or null in this case. Although not many people would request routing the way I do, if we're in a Partial Update scenario using z.object.partial, the validator will pass the validation. My current workaround is to use the refine method to reject empty objects during validation.

[yusukebe]

Yeah, undefined may be better than {}. We have to consider fixing it, but it introduces a breaking change. We can't do it immediately.