Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a sample article with HTTP request and response #733

Merged
merged 4 commits into from
May 24, 2021
Merged

Add a sample article with HTTP request and response #733

merged 4 commits into from
May 24, 2021

Conversation

patrickceg
Copy link
Contributor

@patrickceg patrickceg commented Mar 28, 2021

This PR covers issue #583 .

  • This PR handles the first part of the task which is to establish a standard format for HTTP messages. After agreeing on a format, we should create tasks to fix non-compliant articles. (We don't want to deal with all non-compliant articles in one PR as there are over 20 articles with HTTP messages in them.)
  • You have validated the need for this change.

What did this PR accomplish?

  • Add specific content format instructions to readme for the template
  • Add page for formatting HTML requests

Thank you for your contribution!

@github-actions

This comment has been minimized.

@kingthorin
Copy link
Collaborator

Thanks for tackling this. I'll try to get it reviewed this week.

Copy link
Collaborator

@victoriadrake victoriadrake left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is balanced guidance that will give us uniformity without bloat.

Comment on lines 48 to 52
- The HTTP request and response have text describing them to the reader before the request and response.
- The GET request has the smallest amount of headers to have the desired response from the server.
- For example, there is no `User-Agent:` as it is not needed for the "test case".
- The article uses ellipsis `...` to cut out unnecessary parts of the response.
- Unnecessary response content for this sample include the `Content-Type:` header and the rest of the HTML in the body.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perfect! I'm 💯 on this approach.

@victoriadrake victoriadrake linked an issue Mar 30, 2021 that may be closed by this pull request
@ThunderSon
Copy link
Collaborator

@victoriadrake can we maybe add a reference of this in the main template so that people following it would make sure to see this?

@rbsec as you mentioned in a previous comment, the HTTP request doesn't declare if this is under TLS, and yet I don't see a need for that, unless we're talking about the TLS section. Do you think we should include an example for a clear representation of a HTTPS request? Like this: GET https://example.com/home/ HTTP/1.1

@rbsec
Copy link
Collaborator

rbsec commented Apr 3, 2021

@ThunderSon I don't like including the protocol inside a GET request like that, because it's not a valid request, and will confuse people. I think in the few cases it does matter, it's probably better to just explain it in the preceding sentence?


The other option (and the one I'd normally use in a report), is to format it something like the below (although looks a bit messy on GitHub with the line spacing before the code block):

POST https://example.org/login

X-Token: SecretStuff
[...]
user=foo;password=bar

The response then includes the HSTS header:

200 OK
HSTS: True

@victoriadrake
Copy link
Collaborator

@victoriadrake can we maybe add a reference of this in the main template so that people following it would make sure to see this?

Do you mean this page? I'm happy to do that in a new PR once this gets settled.

@victoriadrake victoriadrake added this to the v5.0 Release milestone Apr 11, 2021
@github-actions
Copy link

Please comment if you are still working on this PR, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it for new contributors to take over.

victoriadrake
victoriadrake previously approved these changes May 17, 2021
Copy link
Collaborator

@victoriadrake victoriadrake left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If there are no objections...

@kingthorin
Copy link
Collaborator

#733 (comment) is still outstanding (just to settle on square brackets or not)

@victoriadrake victoriadrake dismissed their stale review May 19, 2021 09:27

Example to update

Copy link
Collaborator

@victoriadrake victoriadrake left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Update examples

Copy link
Collaborator

@kingthorin kingthorin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you both

Copy link
Collaborator

@kingthorin kingthorin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks even better now 😀

Copy link
Collaborator

@ThunderSon ThunderSon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great job everyone, thank you!

@ThunderSon ThunderSon merged commit b6ec92d into OWASP:master May 24, 2021
victoriadrake added a commit that referenced this pull request May 25, 2021
kingthorin pushed a commit that referenced this pull request May 25, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Standardizing capture output
5 participants