415 Unsupported Media Type (tested)

A 415 Unsupported Media Type means the server refused the request body because of its Content-Type (or its charset or Content-Encoding). Almost always the body is valid JSON and the header is wrong or missing. We sent the same {"a":1} from five clients and into three frameworks: only Flask returned 415 for a missing JSON header; Express and FastAPI failed differently, which is why this bug is easy to misread.

1. What each client sends by default

Logged by a Node.js echo server. The body was always the JSON text {"a":1} unless noted:

So fetch plus JSON.stringify without a header, curl -d, and requests data= with a string all send JSON labelled as something else. The client fixes:

// fetch
fetch(url, {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify(obj)});

# curl (measured with 8.14.1)
curl --json '{"a":1}' https://api.example.com/x
# or
curl -H 'Content-Type: application/json' -d '{"a":1}' https://api.example.com/x

# Python requests
requests.post(url, json=obj)

2. Flask 3.1.3: real 415

The 415 page says: Did not attempt to load JSON data because the request Content-Type was not 'application/json'. Flask accepts any application/*+json type (request.is_json was True for both). Malformed JSON with the right header is a different error: 400 Bad Request. Fix the client; use force=True only if you must accept clients you cannot change.

3. Express 5.2.1: no 415, just an empty body

express.json() skips any request whose type does not match and calls the next handler with req.body left undefined:

The usual symptom is therefore a 500, not a 415: a handler doing const {a} = req.body threw TypeError: Cannot destructure property 'a' of 'req.body' as it is undefined. Three fixes, all measured:

// a) Accept extra types as JSON (text/plain then parsed to {a: 1})
app.use(express.json({type: ['application/json', 'text/plain']}));

// b) Reject wrong types explicitly with a real 415
app.post('/items', (req, res, next) => {
  if (!req.is('application/json'))
    return res.status(415).json({error: 'Content-Type must be application/json'});
  next();
}, express.json(), handler);

// c) Fix the client (section 1) - the right answer when you own both sides

Option (b) returned 415 for text/plain, form-urlencoded and a missing header, and 200 for application/json; charset=utf-8. For application/*+json types use express.json({type: ['application/json', 'application/*+json']}).

4. FastAPI 0.142.2: 422, not 415

The 422 body is easy to misread because it shows your JSON as a string: {"type":"model_attributes_type","loc":["body"],"msg":"Input should be a valid dictionary or object to extract fields from","input":"{\"a\":1}"}. If input is a quoted string of your JSON, the Content-Type was wrong; fix it on the client.

5. Browsers: the JSON header triggers a CORS preflight

In Chromium 153, from http://127.0.0.1:8985 to http://localhost:8986 (an API that sent Access-Control-Allow-Origin: *):

The console said: Request header field content-type is not allowed by Access-Control-Allow-Headers in preflight response. Do not "fix" a 415 by dropping the header to avoid the preflight; that just moves you to the Express or FastAPI failure above. Answer the OPTIONS request with Access-Control-Allow-Headers: Content-Type instead.

6. Checklist

• Look at the request in DevTools Network or with curl -v: is the Content-Type line there, and is it application/json?
• fetch: add headers: {'Content-Type': 'application/json'}. curl: use --json. requests: use json=.
• A charset other than UTF-8 (Express) or an unknown Content-Encoding also gives 415; send application/json or application/json; charset=utf-8.
• Uploads: send the file's real type (multipart/form-data via FormData, without setting the header yourself, so the boundary is added).

For the JSON header itself see Content-Type: application/json, and for charset decoding see Content-Type charset=utf-8.

Written with AI assistance. Measured on 2026-10-02 with Node.js 24.21.0 (built-in fetch, and an http.createServer echo server on localhost:8985-8986 that logged the Content-Type of every request), curl 8.14.1, Python 3.13.5 with requests 2.32.3, Express 5.2.1 (body-parser 2.3.0), Flask 3.1.3 (Werkzeug 3.1.9), FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5, uvicorn 0.54.0) and headless Chromium 153.0.8010.12 (Playwright) for the CORS preflight test. Every request body was the same JSON string {"a":1}; only the Content-Type changed. Spring and ASP.NET Core were not run here. PlainHeaders is our extension; Node.js, curl, Python, Express, Flask, FastAPI and Chromium are free.