-
-
Notifications
You must be signed in to change notification settings - Fork 23
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
http method override challenges solution
- Loading branch information
1 parent
4416747
commit 7c7e6c9
Showing
4 changed files
with
107 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
60 changes: 60 additions & 0 deletions
60
...sources/content/apichallenges/solutions/method-override/all-method-overrides.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| --- | ||
| date: 2025-01-01T14:54:00Z | ||
| title: API Challenges Solution For - Method Override Challenges | ||
| description: How to solve API challenges for Method Override DELETE, PATCH, TRACE. | ||
| --- | ||
|
|
||
| # How to complete the HTTP Method Override Challenges | ||
|
|
||
| All of the method override challenges use the same mechanism so we can cover them all in this solution. | ||
|
|
||
| Sometimes tools and libraries will not issue TRACE or PATCH requests. There is a specific HTTP header we can use to try and have POST requests treated as other verbs. | ||
|
|
||
| The header "X-HTTP-Method-Override" is not guaranteed to work on every server, but some HTTP servers will take this header and treat the request using the value in the header: | ||
|
|
||
| `X-HTTP-Method-Override: DELETE` | ||
|
|
||
| This is worth understanding because it might also be used to bypass validation, or trigger functionality that the user is not authorized to trigger. | ||
|
|
||
|
|
||
| ## POST /heartbeat | ||
|
|
||
| > Issue a `POST` request to `/heartbeat` with an `X-HTTP-Method-Override` header specifying the verb you actually want | ||
| - `POST` request can be sent by all tools | ||
| - We need to add the header `X-HTTP-Method-Override` to the request and the value should be the verb we want to send e.g. `TRACE` | ||
|
|
||
|
|
||
| ## Basic Instructions | ||
|
|
||
| Each challenge requires a different verb, but the process is the same for each, the only difference is the value of the `X-HTTP-Method-Override` header | ||
|
|
||
| - Issue a POST request to end point "/heartbeat" | ||
| - The request should have an `X-HTTP-Method-Override` with the value associated with the challenge i.e. `DELETE`, `PATCH`, `TRACE` | ||
| - The request should have an `X-CHALLENGER` header to track challenge completion | ||
| - The response status code should match the value for teh challenge overridden verb | ||
| - for `DELETE` be `405` | ||
| - for `TRACE` be `501` | ||
| - for `PATCH` be `500` as the API is simulating a server error | ||
|
|
||
| NOTE: This header feature is normally implemented by the HTTP server so often development teams are not even aware that this is possible. Depending on how requests are validated in code it might be possible for someone, who has amend access using `POST` but who does not have `DELETE` access, to be able to use this header approach to delete something. | ||
|
|
||
| NOTE: As an additional exercise, you might want to see if you can DELETE todos using a POST and the `X-HTTP-Method-Override` header. Experiment and see what you can achieve using this approach. | ||
|
|
||
| ## Example Request | ||
|
|
||
| ~~~~~~~~ | ||
| > POST /todos/3 HTTP/1.1 | ||
| > Host: {{<HOST_URL>}} | ||
| > User-Agent: rest-client | ||
| > X-HTTP-Method-Override: DELETE | ||
| > X-CHALLENGER: x-challenger-guid | ||
| > Content-Type: application/json | ||
| > Accept: */* | ||
| > Content-Length: 108 | ||
| ~~~~~~~~ | ||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
40 changes: 40 additions & 0 deletions
40
...r/restassured/_16_http_method_override_challenges/CXXXextraDeleteExistingTodo200Test.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| package uk.co.compendiumdev.challenger.restassured._16_http_method_override_challenges; | ||
|
|
||
| import io.restassured.RestAssured; | ||
| import io.restassured.http.ContentType; | ||
| import org.junit.jupiter.api.Test; | ||
| import uk.co.compendiumdev.challenger.payloads.Todo; | ||
| import uk.co.compendiumdev.challenger.restassured.api.RestAssuredBaseTest; | ||
| import uk.co.compendiumdev.challenger.restassured.api.TodosApi; | ||
|
|
||
| public class CXXXextraDeleteExistingTodo200Test extends RestAssuredBaseTest { | ||
|
|
||
| @Test | ||
| void canDeleteATodoItem(){ | ||
|
|
||
| TodosApi api = new TodosApi(); | ||
|
|
||
| Todo created = api.createTodo("my new todo", | ||
| "my description", | ||
| true); | ||
|
|
||
| RestAssured. | ||
| given(). | ||
| header("X-CHALLENGER", xChallenger). | ||
| header("X-HTTP-Method-Override", "DELETE"). | ||
| accept("application/json"). | ||
| post(apiPath( "/todos/" + created.id)). | ||
| then(). | ||
| statusCode(200). | ||
| contentType(ContentType.JSON); | ||
|
|
||
| // check it was actually deleted | ||
| RestAssured. | ||
| given(). | ||
| accept("application/json"). | ||
| get(apiPath( "/todos/" + created.id)). | ||
| then(). | ||
| statusCode(404); | ||
| } | ||
|
|
||
| } |