[Frontend] Validate JSON body and request_ids in /inference/v1/abort_requests

vllm/entrypoints/scale_out/token_in_token_out/api_router.py

@@ -7,7 +7,9 @@
 from http import HTTPStatus
 
 from fastapi import APIRouter, Depends, FastAPI, HTTPException, Request, Response
+from fastapi.exceptions import RequestValidationError
 from fastapi.responses import JSONResponse, StreamingResponse
+from pydantic import ValidationError
 
 from vllm.engine.protocol import EngineClient
 from vllm.entrypoints.serve.tokenize.serving import ServingTokenization
@@ -20,6 +22,7 @@
 
 from ...serve.engine.protocol import ErrorResponse
 from .protocol import (
+    AbortRequestsRequest,
     GenerateRequest,
     GenerateResponseBase,
 )
@@ -87,14 +90,17 @@ async def abort_requests(raw_request: Request):
             status_code=HTTPStatus.BAD_REQUEST.value,
             detail=f"JSON decode error: {e}",
         ) from e
-    request_ids = body.get("request_ids")
-    if request_ids is None:
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST.value,
-            detail="Missing 'request_ids' in request body",
-        )
+    # Validate the parsed body instead of declaring it as a FastAPI body param:
+    # FastAPI's strict content-type check would then reject clients that send
+    # no `Content-Type`, which the legacy `/abort_requests` path still allows.
+    try:
+        request = AbortRequestsRequest.model_validate(body)
+    except ValidationError as e:
+        raise RequestValidationError(
+            errors=[{**err, "loc": ("body", *err["loc"])} for err in e.errors()]
+        ) from e
     # Abort requests in background
-    asyncio.create_task(engine_client(raw_request).abort(request_ids))
+    asyncio.create_task(engine_client(raw_request).abort(request.request_ids))
     return Response(status_code=200)
 
 

vllm/entrypoints/scale_out/token_in_token_out/protocol.py

@@ -662,6 +662,12 @@ def output_mode_or_tokens(value: Any) -> Any:
 ]
 
 
+class AbortRequestsRequest(BaseModel):
+    """Request for the /inference/v1/abort_requests endpoint."""
+
+    request_ids: str | list[str]
+
+
 class DerenderChatRequest(BaseModel):
     """Request for the /v1/chat/completions/derender endpoint (non-streaming).