Dredd: Dredd HTTP client should not follow redirects

[argos83]

Describe your problem

I'm unable to verify one of my API endpoints which produces a 303 redirect to an external service

My endpoint API (swagger) looks like this

  /signed_url:
    get:
      description: |
        Redirect to S3 object download url
      consumes: []
      parameters:
         - name: id
           in: query
           description: the S3 object key
           required: true
           type: string
           x-example: 123
      responses:
        '303':
          description: Redirect response to S3
          headers:
            Location:
              description: The S3 signed url to the requested object
              type: string
              format: uri

I would like Dredd to verify the expectations on my service response, instead it follows the redirect and checks the expectations on the external service response (which of course won't match my API specification and fails the test).
I can't think of a use case in which following redirects would be a desired behavior, but if so it should be an opt-in setting.

What command line options do you use?

$ dredd api.swagger.yaml "${BASE_URL}" --hookfiles=./test/dredd-hooks/*.js

What is in your dredd.yml?

no dredd.yml

What's your dredd --version output?

dredd v3.5.0 (Darwin 16.6.0; x64)

Can you send us failing test in a Pull Request?

If you agree on this being a bug I can create a PR with a fix.

[honzajavorek]

Thanks for an excellent report!

I need to check with @netmilk what is the intended behavior, but I think you're right, this looks like a bug. I can imagine Dredd would follow redirects, but probably only if asked, e.g. by a specific command-line option. My hunch is that this behavior was introduced with replacing the native HTTP(S) request implementation with the request library in https://github.com/apiaryio/dredd/pull/749 The next steps should be:

• Install version of Dredd before https://github.com/apiaryio/dredd/pull/749 and try whether it follows redirects. If yes, then this is clearly a bug. If not, this is a feature request 😄
• Write a failing test for the correct behavior
• Fix the behavior, make the test passing

Any help with the above would be greatly appreciated.

[honzajavorek]

I checked with @netmilk and he says previously Dredd did not follow redirects. This is a bug, regression.

[argos83]

FYI, responses for POST containing a redirect were not being followed. Only GET responses with redirection. Anyways, I've added tests for both cases.

[honzajavorek]

Released as v3.5.1 🎉

[yogevglucome]

@honzajavorek As you said before, is there any way to use some flag to allow Dredd to follow redirect?
We have a case that we perform GET test, which returns 301 and then 201 or 500, and we do want to know what was the final status code.

[honzajavorek]

To me that sounds more like testing a workflow. In fact following redirects means you are doing multiple requests to the API and you expect keeping some state between them.

[yogevglucome]

Not necessarily.
For example, if you test some UI rest, which return HTML and not Json, you
might go through several redirects in one call.
In any case, I am not sure that Dredd is good enough for workflows, as
creating several APIs doc is not efficient.

On Thu, Oct 19, 2017 at 12:53 PM, Honza Javorek [e-mail]
wrote:

To me that sounds more like testing a workflow
https://dredd.readthedocs.io/en/latest/how-to-guides.html#testing-api-workflows.
In fact following redirects means you are doing multiple requests to the
API and you expect keeping some state between them.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/apiaryio/dredd/issues/795#issuecomment-337872519, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AfUKwARn7na6k-fMmx_CYRtidpxy2d69ks5styovgaJpZM4NpsnN
.

[honzajavorek]

@yogevglucome Dredd is, currently, definitely better as a unit/isolated test tool. Hooks give you some flexibility, but not as much convenience as there could be. The problem is also with API descriptions, which have basically zero support for workflows as of now.

[MikeRalphson]

When the expected result-code of an API call is a 30x redirect, Dredd appears to skip the test. I appreciate this is not necessarily a common scenario, but I have a real-life API which responds with redirects to images and it would be nice to increase the test coverage further.

[honzajavorek]

Turned this into a feature request 🙂

[MikeRalphson]

Thanks! Just to be clear, my use-case is for the 30x response of a GET request itself to be validated, not followed.

[honzajavorek]

@MikeRalphson Dredd currently does not follow redirects. That means when the test request is redirected, Dredd validates the API description response spec against the 3xx response.

As I understood your wish, you want Dredd to have an option (either a real CLI option or a way to turn the thing on in hooks) to follow redirects, i.e. when provided with 3xx response from the server under test, it would follow the Location header and validate the API description response spec against the resulting response (let's say 2xx, 4xx, whatever is there).

Am I correctly interpreting your wish?

[honzajavorek]

(If Dredd follows the redirect, it is a bug again, but 516c941 contains regression test, so that shouldn't happen...)

[MikeRalphson]

@honzajavorek No, I specifically don't want Dredd to follow the redirect. At the moment, with a swagger definition Dredd skips the test because it has a non-200 expected status code. I would like Dredd to perform the test and validate the 3xx status code is returned.

It may be skipping the test for some other reason I don't understand.

[honzajavorek]

@MikeRalphson Ah! That's something else then. By default Dredd tests only 2xx responses in Swagger, but you can use hooks to unskip any other ones to test them. Example of such hooks is here.

[honzajavorek]

@MikeRalphson If you think the default behavior should be different, let's talk about it, but better let's file a separate issue.

[MikeRalphson]

Thanks @honzajavorek that should do it. I don't think testing redirects is a common-enough use-case to bother changing the defaults.