Return 406 Not Acceptable for malformed Accept headers

Gemfile.lock

@@ -134,12 +134,12 @@ GEM
       citeproc (~> 1.0, >= 1.0.9)
       csl (~> 2.0)
       observer (< 1.0)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.7)
     connection_pool (3.0.2)
     crack (1.0.1)
       bigdecimal
       rexml
-    crass (1.0.6)
+    crass (1.0.7)
     csl (2.2.1)
       forwardable (~> 1.3)
       namae (~> 1.2)
@@ -167,11 +167,11 @@ GEM
       unicode-types (~> 1.8)
     edtf (3.2.0)
       activesupport (>= 3.0, < 9.0)
-    erb (6.0.2)
+    erb (6.0.4)
     erubi (1.13.1)
-    excon (1.4.2)
+    excon (1.5.0)
       logger
-    faraday (2.14.1)
+    faraday (2.14.3)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
@@ -187,7 +187,7 @@ GEM
       zlib (~> 3.0)
     faraday-multipart (1.2.0)
       multipart-post (~> 2.0)
-    faraday-net_http (3.4.2)
+    faraday-net_http (3.4.4)
       net-http (~> 0.5)
     ffi (1.17.4)
     ffi (1.17.4-arm64-darwin)
@@ -207,7 +207,7 @@ GEM
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
     iso8601 (0.13.0)
-    json (2.19.5)
+    json (2.21.1)
     json-canonicalization (1.0.0)
     json-ld (3.3.2)
       htmlentities (~> 4.3)
@@ -276,7 +276,7 @@ GEM
       racc (~> 1.7)
     net-http (0.9.1)
       uri (>= 0.11.1)
-    net-imap (0.6.3)
+    net-imap (0.6.4.1)
       date
       net-protocol
     net-pop (0.1.2)
@@ -286,15 +286,15 @@ GEM
     net-smtp (0.5.1)
       net-protocol
     nio4r (2.7.5)
-    nokogiri (1.19.3)
+    nokogiri (1.19.4)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nokogiri (1.19.3-arm64-darwin)
+    nokogiri (1.19.4-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.3-x86_64-darwin)
+    nokogiri (1.19.4-x86_64-darwin)
       racc (~> 1.4)
     observer (0.1.2)
-    oj (3.17.0)
+    oj (3.17.4)
       bigdecimal (>= 3.0)
       ostruct (>= 0.2)
     oj_mimic_json (1.0.1)
@@ -321,7 +321,7 @@ GEM
     rack-cors (3.0.0)
       logger
       rack (>= 3.0.14)
-    rack-session (2.1.1)
+    rack-session (2.1.2)
       base64 (>= 0.1.0)
       rack (>= 3.0.0)
     rack-test (2.2.0)
@@ -480,7 +480,7 @@ GEM
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    websocket-driver (0.8.0)
+    websocket-driver (0.8.2)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)

config/initializers/catch_invalid_mime_type.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+# Invalid Accept headers raise ActionDispatch::Http::MimeNegotiation::InvalidType
+# during ActionController::Instrumentation#process_action (before rescue_from runs).
+# Handle the exception here, inside DebugExceptions, to avoid multi-line backtraces.
+class CatchInvalidMimeTypeMiddleware
+  RESPONSE_BODY = "Not Acceptable: invalid or missing Accept header"
+
+  def initialize(app)
+    @app = app
+  end
+
+  def call(env)
+    @app.call(env)
+  rescue ActionDispatch::Http::MimeNegotiation::InvalidType
+    [406, { "Content-Type" => "text/plain" }, [RESPONSE_BODY]]
+  end
+end
+
+Rails.application.config.middleware.insert_after ActionDispatch::DebugExceptions,
+                                                  CatchInvalidMimeTypeMiddleware

spec/api/api_spec.rb

@@ -291,6 +291,15 @@
     end
   end
 
+  context "invalid accept header" do
+    it "returns 406 for malformed Accept header" do
+      get "/#{doi}", nil, { "HTTP_ACCEPT" => "application/json, *" }
+
+      expect(last_response.status).to eq(406)
+      expect(last_response.body).to eq("Not Acceptable: invalid or missing Accept header")
+    end
+  end
+
   context "registration agency op in datacite index" do
     let (:doi) { "10.2899/caricom/1" }