DependencyTrack / DependencyTrack/dependency-track

Various mutation endpoints return 304 when the target resource is not modified

Open
#6,954 2 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Certain mutation APIs (see search links below for the exact set) return 304 (HTTP Not Modified) when the call did not cause any change (for example PUT on api/v1/permission/team).

This contradicts [RFC9110 (HTTP Semantics)](https://www.rfc-editor.org/info/rfc9110/#status.304) which states that 304 is for conditional GET / HEAD.

To get a list of the endpoints, use these searches:
- https://github.com/search?q=repo%3ADependencyTrack%2Fdependency-track+Response.Status.NOT_MODIFIED&type=code
- https://github.com/search?q=repo%3ADependencyTrack%2Fdependency-track++Response.notModified%28%29&type=code

### Steps to Reproduce

Call [setTeamPermissions](https://github.com/DependencyTrack/dependency-track/blob/504f17b400c54c3ad0d3ae2b778440caa7d1e64b/apiserver/src/main/java/org/dependencytrack/resources/v1/PermissionResource.java#L356) (`/api/v1/permission/team`) twice with the same body.

The second call returns 304

### Expected Behavior

The second call returns 200 or 204.

[RFC9110 somewhat specifies this for PUT](https://www.rfc-editor.org/info/rfc9110/#PUT)

> If the target resource does not have a current representation and the PUT successfully creates one, then the origin server MUST inform the user agent by sending a [201 (Created)](https://www.rfc-editor.org/info/rfc9110/#status.201) response. If the target resource does have a current representation and that representation is successfully modified in accordance with the state of the enclosed representation, then the origin server MUST send either a [200 (OK)](https://www.rfc-editor.org/info/rfc9110/#status.200) or a [204 (No Content)](https://www.rfc-editor.org/info/rfc9110/#status.204) response to indicate successful completion of the request.

Note that there is no mention of non-modifying PUTs.

### Dependency-Track Version

5.x

### Browser

N/A

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Research direction

Start at apiserver/src/main/java/org/dependencytrack/resources/v1/PermissionResource.java, especially setTeamPermissions, then inspect the linked code searches for Response.Status.NOT_MODIFIED and Response.notModified(). Verify that repeating a mutation such as /api/v1/permission/team returns 200 or 204 rather than 304 for every affected endpoint.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.