Reading the request body in the malformed_request/2 callback

[matlaj]

I was thinking of handling all input validation (query strings, maybe certain header values, but also the request body) inside the malformed_request/2 cowboy_rest callback, but the documentation says that "the body should not be read at this point".

Why is that? Is it just because malformed_request/2 is called before valid_entity_length/2? Would anything break if I read the body early?

[essen]

In some cases you have to read the body earlier than the accept functions. But reading the body before all other checks are complete means you risk wasting resources if a subsequent check fails. You also aren't supposed to know what content-type is used for the body at that point. And if you have to stream read the body, you pretty much have to do that in accept callbacks anyway.

Typically malformed_request, uri_too_long and the valid_* callbacks aren't necessary as Cowboy already has checks for most things. But if your resource requires extra checks then you can do them there.

Sometimes you do have to read the body earlier, so if you really have to do it, do it. If not, defer the reading until the accept callbacks.