DependencyTrack / DependencyTrack/dependency-track
Various mutation endpoints return 304 when the target resource is not modified
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Certain mutation APIs (see search links below for the exact set) return 304 (HTTP Not Modified) when the call did not cause any change (for example PUT on api/v1/permission/team).
This contradicts [RFC9110 (HTTP Semantics)](https://www.rfc-editor.org/info/rfc9110/#status.304) which states that 304 is for conditional GET / HEAD.
To get a list of the endpoints, use these searches:
- https://github.com/search?q=repo%3ADependencyTrack%2Fdependency-track+Response.Status.NOT_MODIFIED&type=code
- https://github.com/search?q=repo%3ADependencyTrack%2Fdependency-track++Response.notModified%28%29&type=code
### Steps to Reproduce
Call [setTeamPermissions](https://github.com/DependencyTrack/dependency-track/blob/504f17b400c54c3ad0d3ae2b778440caa7d1e64b/apiserver/src/main/java/org/dependencytrack/resources/v1/PermissionResource.java#L356) (`/api/v1/permission/team`) twice with the same body.
The second call returns 304
### Expected Behavior
The second call returns 200 or 204.
[RFC9110 somewhat specifies this for PUT](https://www.rfc-editor.org/info/rfc9110/#PUT)
> If the target resource does not have a current representation and the PUT successfully creates one, then the origin server MUST inform the user agent by sending a [201 (Created)](https://www.rfc-editor.org/info/rfc9110/#status.201) response. If the target resource does have a current representation and that representation is successfully modified in accordance with the state of the enclosed representation, then the origin server MUST send either a [200 (OK)](https://www.rfc-editor.org/info/rfc9110/#status.200) or a [204 (No Content)](https://www.rfc-editor.org/info/rfc9110/#status.204) response to indicate successful completion of the request.
Note that there is no mention of non-modifying PUTs.
### Dependency-Track Version
5.x
### Browser
N/A
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Research direction
Start at apiserver/src/main/java/org/dependencytrack/resources/v1/PermissionResource.java, especially setTeamPermissions, then inspect the linked code searches for Response.Status.NOT_MODIFIED and Response.notModified(). Verify that repeating a mutation such as /api/v1/permission/team returns 200 or 204 rather than 304 for every affected endpoint.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 65/100