DependencyTrack / DependencyTrack/dependency-track
REST API does not conform with HTTP spec
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
REST API method usage does not conform to HTTP specifications https://www.rfc-editor.org/rfc/rfc9110
Some examples:
| Method | RFC / best practices | this API | Hint |
|---|---|---|---|
| PUT | replaces a resource with the request payload, e.g /project/{project-id} | create a resource | move PUT operation under POST |
| PATCH | use a specific media type (e.g. merge-patch+json) | use application/json | enforce merge-patch+json |
| POST | used to create resources, returns the Location header | used to update a resource but points to the parent | when uuid is not present, should create the resource |
If you are interested, I can provide further feedback.
### Steps to Reproduce
## e.g. POST updates a project
```python
requests.post(
"http://localhost:8081/api/v1/project",
data={"name": "foo", "description": "bar", "classifier":"APPLICATION"}
headers={"X-API-Key": SBOM_TOKEN, "Content-Type": "application/json"},
)
b'The UUID of the project could not be found.'
```
### Expected Behavior
## POST creates a project when uuid is not provided
### Dependency-Track Version
4.6.x
### Dependency-Track Distribution
Container Image
### Database Server
N/A
### Database Server Version
_No response_
### Browser
Google Chrome
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.