"leaked metadata was detected" error when trying to send 'moderation_state':'published' via JSON:API.

Thanks for taking the time to report the problem you're encountering! We'd love to help you fix this, and if it turns out to be a bug on our end, we'd be happy to fix that too of course :)

You've provided fairly clear steps to reproduce already, but what's not yet clear is whether this is happening with just Drupal core or whether you've also got contributed modules installed.

If you want to see this resolved very quickly, then adding a failing test case to \Drupal\Tests\jsonapi\Functional\JsonApiRegressionTest that reproduces your scenario would guarantee that. If you don't have the time for that, that's fine too, we'll help you as soon as we can!

@justinross would you be able to have a clean local Drupal installation and try to reproduce without any contributed modules?

Thanks for checking back in @justinross. That's much appreciated! Feel free to re-open this issue if you get more information pointing to a bug.

I came across this issue when this same error showed for me. This error shows when I have Automatic Entity Label enabled on the Content Type. When I disable the Auto Entity Label, the POST returns a successful -201 Created-status. Note: I do not have Content Moderation module installed.

@aytee. I got the same issue with module Automatic Entity Label
There is a discussion here https://www.drupal.org/project/auto_entitylabel/issues/3051165

When this lands, it should also resolve this issue. If you'd like to help it land sooner, you can add the remaining test coverage thats needed. That'd be awesome! 🙏

I faced the same issue when I was using the group module.

This patch resolved my issue.

https://www.drupal.org/project/group/issues/3066456

Error:
A fatal error occurred: The controller result claims to be providing relevant cache metadata, but leaked metadata was detected. Please ensure you are not rendering content too early.

Solution of above issue is:

Add use Drupal\rest\ModifiedResourceResponse;

When you returning response use below.

//return new ResourceResponse($response);
return new ModifiedResourceResponse($response);

I hope problem will be resolve.

I'm also having this same problem: the 500 error on the POST. It's not clear from the thread what I am supposed to do to work around it. I've made some progress narrowing down the error, however. I created a new site just to focus on this problem, separate from the system where I ran into this issue.

UPDATE: I have a workaround. I just disabled the module Content Synchronization and the error went away. Not that big a deal.

So, on a brand new site with ONLY JSON:API, Serialization and HTTP Basic Authentication I cannot reproduce the problem. It works fine. Awesome! Subsequently, I enabled Media, RESTUI and RESTful services. Still no problem. This is really great news. The problem probably lies in one of these other modules: Media Library or Content Sync. Or perhaps the order I added these additional serivces matter? Or there is some other difference I cannot name that distinguishes the working site from the one that returns a 500 on a POST.

But I have a few of other modules I need to make this work, including Group. It would be great to know what's the plan for fixing this.

But now, let's return to the server that DOES NOT work. Here are the details:

This is my Drupal configuration:
- version: 8.8.6
- modules: Content Synchronization 8.x-2.1
- REST UI 8.x-1.18
- no other modules... but there ARE other services enabled
- I have also enabled JSON:API, serialization, HTTP Basic Authentication, HAL, RESTful Web Services and REST. I have also enabled Media, Media Library, Content Sync, although these don't appear on my update report. Perhaps they are all part of CORE? Not sure I understand...

I'm using all of the default settings except what I needed to enable jsonapi. I have experimented with the group module and other modules but this is a clean install of 8.8.5 and a manual upgrade to 8.8.6 that I just use for testing. (I'm not familiar with drush or composer).

Here is the code I used to run the test.

#!/usr/bin/env python3
# -*- coding: cp1252 -*-

import json
import requests
from requests.auth import HTTPBasicAuth

payload = {}
payload['data'] = {}
payload['data']['type'] = "node--article"
payload['data']['attributes'] = {}
payload['data']['attributes']['title'] = 'Test article'
payload['data']['attributes']['body'] = {}
payload['data']['attributes']['body']['value'] = 'Test article body'
payload['data']['attributes']['body']['format'] = 'basic_html'
payloadStr = json.dumps(payload) # make sure this is not encoded by requests

header = {}
header["Content-Type"] = "application/vnd.api+json"

endpoint = "http://.../drupal8/jsonapi/node/article"

username = 'xxxxx'
password = 'xxxxxxxxxxxxxxx'

req = requests.post(endpoint, data = payloadStr, auth = HTTPBasicAuth(username, password), headers = header)
print("Status: {}".format(req.status_code))
print("URL: {}".format(req.url))
print("Request headers: {}".format(req.request.headers))
print("Reply headers: {}".format(req.headers))
print("Reply: {}".format(json.dumps(json.loads(req.text), indent=2)))

Here is the output.

Status: 500

URL: http://.../drupal8/jsonapi/node/article

Request headers: {'User-Agent': 'python-requests/2.23.0', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-alive', 'Content-Type': 'application/vnd.api+json', 'Content-Length': '140', 'Authorization': 'Basic U1FhZG1pbjpEaXN0RWNobyExOE9ybmFEYXY='}

Reply headers: {'Server': 'nginx/1.14.0', 'Date': 'Fri, 22 May 2020 16:39:04 GMT', 'Content-Type': 'application/vnd.api+json', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'Cache-Control': 'must-revalidate, no-cache, private', 'X-UA-Compatible': 'IE=edge', 'Content-language': 'en', 'X-Content-Type-Options': 'nosniff', 'X-Frame-Options': 'SAMEORIGIN', 'Expires': 'Sun, 19 Nov 1978 05:00:00 GMT', 'Vary': '', 'X-Generator': 'Drupal 8 (https://www.drupal.org)'}

Reply: {
"jsonapi": {
"version": "1.0",
"meta": {
"links": {
"self": {
"href": "http://jsonapi.org/format/1.0/"
}
}
}
},
"errors": [
{
"title": "Internal Server Error",
"status": "500",
"detail": "The controller result claims to be providing relevant cache metadata, but leaked metadata was detected. Please ensure you are not rendering content too early. Returned object class: Drupal\\jsonapi\\ResourceResponse.",
"links": {
"via": {
"href": "http://.../drupal8/jsonapi/node/article"
},
"info": {
"href": "http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.5.1"
}
},
"source": {
"file": "/.../drupal8/core/modules/jsonapi/src/EventSubscriber/DefaultExceptionSubscriber.php",
"line": 48
},
"meta": {
"exception": LogicException: The controller result claims to be providing relevant cache metadata,
but leaked metadata was detected. Please ensure you are not rendering content too early.
Returned object class: Drupal\\jsonapi\\ResourceResponse. in
/.../drupal8/core/lib/Drupal/Core/EventSubscriber/EarlyRenderingControllerWrapperSubscriber.php:154\nStack trace:\n#0
/.../drupal8/core/lib/Drupal/Core/EventSubscriber/EarlyRenderingControllerWrapperSubscriber.php(97):
Drupal\\Core\\EventSubscriber\\EarlyRenderingControllerWrapperSubscriber->wrapControllerExecutionInRenderContext(Array, Array)\n#1
/.../drupal8/vendor/symfony/http-kernel/HttpKernel.php(151):
Drupal\\Core\\EventSubscriber\\EarlyRenderingControllerWrapperSubscriber->Drupal\\Core\\EventSubscriber\\{closure}()\n#2
/.../drupal8/vendor/symfony/http-kernel/HttpKernel.php(68):
Symfony\\Component\\HttpKernel\\HttpKernel->handleRaw(Object(Symfony\\Component\\HttpFoundation\\Request), 1)\n#3
/.../drupal8/core/lib/Drupal/Core/StackMiddleware/Session.php(57):
Symfony\\Component\\HttpKernel\\HttpKernel->handle(Object(Symfony\\Component\\HttpFoundation\\Request), 1, true)\n#4
/.../drupal8/core/lib/Drupal/Core/StackMiddleware/KernelPreHandle.php(47):
Drupal\\Core\\StackMiddleware\\Session->handle(Object(Symfony\\Component\\HttpFoundation\\Request), 1, true)\n#5
/.../drupal8/core/modules/page_cache/src/StackMiddleware/PageCache.php(106):
Drupal\\Core\\StackMiddleware\\KernelPreHandle->handle(Object(Symfony\\Component\\HttpFoundation\\Request), 1, true)\n#6
/.../drupal8/core/modules/page_cache/src/StackMiddleware/PageCache.php(85):
Drupal\\page_cache\\StackMiddleware\\PageCache->pass(Object(Symfony\\Component\\HttpFoundation\\Request), 1, true)\n#7
/.../drupal8/core/lib/Drupal/Core/StackMiddleware/ReverseProxyMiddleware.php(47):
Drupal\\page_cache\\StackMiddleware\\PageCache->handle(Object(Symfony\\Component\\HttpFoundation\\Request), 1, true)\n#8
/.../drupal8/core/lib/Drupal/Core/StackMiddleware/NegotiationMiddleware.php(52):
Drupal\\Core\\StackMiddleware\\ReverseProxyMiddleware->handle(Object(Symfony\\Component\\HttpFoundation\\Request), 1, true)\n#9
/.../drupal8/vendor/stack/builder/src/Stack/StackedHttpKernel.php(23):
Drupal\\Core\\StackMiddleware\\NegotiationMiddleware->handle(Object(Symfony\\Component\\HttpFoundation\\Request), 1, true)\n#10
/...\\Component\\HttpFoundation\\Request), 1, true)\n#11
/.../drupal8/index.php(19):
Drupal\\Core\\DrupalKernel->handle(Object(Symfony\\Component\\HttpFoundation\\Request))\n#12 {main}