feat: warn when json validator does not find a content type in the request

[Soviut]

When a validator has a target 'json' it will now warn if a request is missing a Content-Type: application/json header.

Closes honojs/middleware#841

Added some docs too honojs/website#540

The author should do the following, if applicable

• Add tests
• Run tests
• bun run format:fix && bun run lint:fix to format the code
• Add TSDoc/JSDoc to document the code

[yusukebe]

Thanks! I'll check it later.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 91.70%. Comparing base (190e122) to head (d83827f).
Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3707   +/-   ##
=======================================
  Coverage   91.70%   91.70%           
=======================================
  Files         159      159           
  Lines       10158    10164    +6     
  Branches     2855     2870   +15     
=======================================
+ Hits         9315     9321    +6     
  Misses        842      842           
  Partials        1        1           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[yusukebe]

Hi @Soviut

Thank you for the PR!

Do you think that we should show a similar message for form?

https://github.com/honojs/hono/pull/3707/files#diff-e3ae0a2a0f7c0f9209a9627ba4da7f499f23e1873275b8d0c0f028e77d9cdee4R87-R93

[Soviut]

@yusukebe Yes, let's do that. I've updated the PR to warn if the target is form but content-type header is missing either multipart/form-data or application/x-www-url-encoded

[EdamAme-x]

I think that this may be an option.

Because a threat actor's malicious request could cause a warning to be logged to the console in a production environment.

[Soviut]

Because a threat actor's malicious request could cause a warning to be logged to the console in a production environment.

What is the concern with that? Wouldn't that help identify threat actors more easily if lots of warnings start showing up in logs?