Only allow properties that are declared in JSON schema

87
votes

I am using json-schema and wanting to only allow properties that are declared in this file to pass validation. For instance if a user passes a "name" property in their json object it will fail this schema because "name" is not listed here as a property.

Is there some function similar to "required" that will only allow the listed properties to pass?

{
"$schema": "http://json-schema.org/draft-04/schema#",
"title": "Accounting Resource - Add Item",
"type": "object",
"properties": {
    "itemNumber": {
        "type":"string",
        "minimum": 3
    },
    "title": {
        "type":"string",
        "minimum": 5
    },
    "description": {
        "type":"string",
        "minimum": 5
    }
},
"required": [
    "itemNumber",
    "title",
    "description"
]
}
3
jsonjsonschema
Even if there is a way, this seems like shooting future extensibility in the foot. – Chris Pitman
Anytime in the future I will just add those properties to this Schema. – ipengineer
@ipengineer - that works (-ish) as long as you are the person doing the extending. It also means that you change a resource which some people might assume is static. – cloudfeet
There's no "-ish" about it. It's not difficult to add new properties to your schema if your API starts to accept new props in the future, no matter the size of your team. If it is, you're probably doing something else wrong. – AJB

3 Answers

123
votes

I believe what you need to do to achieve this is set additionalProperties to false. See the specification here

6
votes

FYI - it looks like v5 of the standard will describe a "ban unknown properties" validation mode.

So instead of making this requirement part of the format (which as Chris Pitman says in the comments, damages future extensibility), you can simply instruct your validator to flag unknown properties as errors. So, it's like a super-strict validation mode which is useful for dev.

Some validators already support this (e.g. tv4):

var result = tv4.validateMultiple(data, schema, checkRecursive, banUnknownProperties);

With this tool, checkRecursive should be used if your data might have circular references, and banUnknownProperties will do exactly what you want, without having to use "additionalProperties":false.

3
votes

Inside your definition provide:

  • all required fields inside "required": []
  • and set "additionalProperties": false

DEMO:

without "additionalProperties": false: enter image description here

with "additionalProperties": false: enter image description here