Problem/Motivation

An Accept-Language read silently falls back to the entity's default translation when the requested language is missing. Internally the module negotiates with Symfony's Request::getPreferredLanguage($available), which returns the first $available langcode (the default translation, passed first) whenever none of the client's languages match; the per-item collection path returns the untranslated entity the same way.

he result is that a client asking for Accept-Language: fr,de can receive an English payload it never requested, unlabelled as a fallback. Clients that must not present a language the user did not ask for (a strict decoupled front end, a language switcher that should 404/hide rather than show the wrong language) have no way to opt out.

Steps to reproduce

  1. Configure a site with en (default), it, and fr, and enable content translation for node.article.
  2. Create an article with en and it translations (no fr).
  3. GET /jsonapi/node/article/{uuid} with Accept-Language: fr → returns the en default translation with 200, instead of signalling that fr is unavailable.
  4. GET /jsonapi/node/article (collection) with Accept-Language: fr → articles without a fr translation are returned in their default language rather than excluded.

Proposed resolution

Treat Accept-Language as the client's ordered accept-list and negotiate strictly, with no implicit fallback.

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

lauriii created an issue. See original summary.

  • lauriii committed 1ec8cd55 on 1.0.x
    feat: #3612442 Accept-Language reads should negotiate strictly, with no...
lauriii’s picture

Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.