The JSON:API spec states:
A server MUST return 409 Conflict when processing a POST request in which the resource object’s type is not among the type(s) that constitute the collection represented by the endpoint. Source
And:
A server MUST return 409 Conflict when processing a PATCH request in which the resource object’s type or id do not match the server’s endpoint. Source
Before this change, JsonApiDocumentTopLevelNormalizer::validateRequestBody() checked only that the request body included a "type" member, but did not check its content (arbitrary strings were accepted for POST and PATCH). Now, the type is validated and must match as required by the JSON:API spec.
Before:
POST /jsonapi/node/article
{"data":{"type":"anything","attributes":{"title":"Example"}}}
Result: 201 Created.After:
POST /jsonapi/node/article
{"data":{"type":"anything","attributes":{"title":"Example"}}}
Result: 409 Conflict. data.type must be node--article.Clients that send the correct type are not affected. Clients sending an invalid type will receive a 409 response.
