i18n Locale Validation#

The i18n plugin's locale validation — checking that a requested locale code actually exists in the list of configured locales — is only applied to Content Manager routes via middleware. The public Content API and the document service do not perform this check, meaning callers can create or manage content under any syntactically valid (or even invalid) locale string without receiving an error.

Where Validation Lives: Content Manager Only#

validateLocaleCreation is a Koa middleware that intercepts POST / PUT requests, extracts the locale from the request query or body, and calls getValidLocale, which queries the database to confirm the locale is configured. If the locale is not found, it throws an ApplicationError("This locale doesn't exist") 1.

This middleware is registered in register.ts on exactly two route prefixes 2:

• /content-manager/collection-types/:model
• /content-manager/single-types/:model

A code comment marks this as a known, intentional gap: // TODO: v5 if implemented in the CM => delete this middleware 3 — the intent is to move this check to a more central layer, but that work has not been done.

What the Document Service Does Instead#

The document service's checkLocale function (in repository.ts) validates format only — it enforces BCP 47 syntax using the regex /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]{2,8})*$/ with a 35-character max length 4. It does not look up the locale against the configured-locales table.

Even this format validation is gated behind the api.documents.strictParams config flag 5. When strictParams is false or unset (the default), locale values pass through completely unchecked at the document service layer.

The i18n transforms in internationalization.ts (defaultLocale, localeToLookup, localeToData) handle locale-to-query translation but perform no configured-locale validation 6. The defaultLocale transform will fall back to the system default locale if none is supplied, and localeToData only checks that the value is a non-wildcard string.

Gap Summary#

Key Files#