Dynamic Verification of Inter-Parameter Constraints in Web - PowerPoint PPT Presentation

‹#› Dynamic Verification of Inter-Parameter Constraints in Web Applications Nathalie Oostvogels ・ Joeri De Koster ・ Wolfgang De Meuter

Third party web services 2

Web API specifications 3

Web API requests request.post( { url: “api.twitter.com/1.1/direct_messages/new.json”, form: { user_id: 42, screen_name: “Alice”, text: “Hello” }}, (error, r, result) => { console.log(result) }); 4

Web API specifications optional number max length optional string = 15 max length required string = 140 5

Automatically Verifying Requests 6

⎬ Dynamic verification request.post( { url: “api.twitter.com/1.1/direct_messages/new.json”, form: { user_id: 42, 
 screen_name: “Alice”, test : “Hello” }}, (error, r, result) => { console.log(result) }); Request to “api.twitter.com/1.1/ � direct_messages/new.json" is incorrect: required field “text” not present. 7

⎬ Dynamic verification request.post( { url: “api.twitter.com/1.1/direct_messages/new.json”, form: { user_id: 42 screen_name: “Alice”, text : “Hello” }}, (error, r, result) => { console.log(result) }); � 8

At runtime… � “Incompatible parameters specified in the request” � “Some co-ordinate parameters were blank” � “You must specify either a list ID or a slug and owner” 9

Inter-parameter constraints ○ constraints defined over multiple parameters Exclusive Dependent Group Constraints Constraints Constraints 10

Automatically Verifying Requests 11

Exclusive constraints ○ exactly one of a set of parameters is required Silent choice: Twitter chooses screen_name over user_id 12

Dependent constraints ○ constraints on a parameter depend on a 
 property of another parameter Silent choice: Facebook ignores details of link when link is not provided 13

Group constraints ○ a set of parameters should either be all 
 excluded from a request or all included Silent choice: Twitter ignores latitude when longitude is not provided 14

Inter-parameter constraints in web APIs # entry XOR Dependent Group points 117 10 3 3 97 32 14 6 50 11 3 5 206 12 0 1 209 11 4 1 9 2 5 2 15

A new specification language for web APIs paths: /direct_messages/new: post: parameters: - name: user_id type: number - name: screen_name type: string - name: text 
 type: string required: true x-constraints: - present(screen_name) XOR present(user_id) 16

Dynamic verification request.post( { url: “api.twitter.com/1.1/direct_messages/new.json”, form: { user_id : 42, screen_name : “Alice”, text: “Hello” }}, (error, r, result) => { console.log(result) }); Request to “api.twitter.com/1.1/direct_messages/new.json" is incorrect: � the exclusive constraint on user_id and screen_name is not satisfied. 17

Inter-parameter constraints in web APIs Error message when � Error message when constraints not satisfied. � constraints not satisfied. � Eliminating vague error messages � Uniform error messages 18

Conclusion ○ When programming against Web APIs, programmers 
 oIen resort to trial and error ○ Introduced tool that transparently intercepts and 
 validates requests according to specificaKon ○ S upports validaKon of inter-parameter constraints ○ Future work: inter-parameter constraints outside 
 of web APIs 19