英文:
Does an HTTP status code 400 with Response "Invalid Credentials" Indicate the the HTTP Client Is Hitting the Endpoint
问题
我有一个简单的HTTP客户端，需要从我公司外部的一个端点获取令牌。我相信这个端点已经被允许访问，然而我的代码返回了BAD REQUEST。当我通过VSCode发送等效请求时，返回了以下响应：
400 Bad Request，但附带了以下内容：
{
"message": "Invalid credentials."
}
这似乎暗示着端点已被访问。是否有人可以提供一些关于这里发生了什么的见解。
Kind Regards
Paul J.
英文:
I have a simple HTTP client which needs to get a token from an endpoint external to my company. My belief is that the endpoint has been whitelisted for access, however my code returns BAD REQUEST. This is confused when I run the equivalent as a request via VSCode, which returns a response of:
400 Bad Request but qualified with the content:
{
"message": "Invalid credentials."
}
Which would seem to imply that the endpoint is being hit. Can anyone provide some insight into what is happening here.
Kind Regards
Paul J.
答案1
得分: 0
只因为你收到了一条消息并不一定意味着你正在访问指定的端点。这将取决于外部网络服务的设置。
例如，我所工作和维护的一个Web API使用AWS API Gateway，并在其前面使用AWS Lambda令牌授权器。所有请求首先通过此授权器，以查看它们是否提供了有效的凭据。如果没有，_授权器_将返回401未经授权的消息，而不是我们试图访问的实际Web API。这就是为什么你不能假设你实际上正在通过这样的测试访问API，因为不清楚服务本身是否执行验证，或者是其他原因。
你可以通过尝试一些虚假的端点并查看响应来_部分地_测试这一点。如果你尝试一个你知道存在的有效端点，然后尝试一个不存在的虚假端点，如果你收到相同的400 { "message": "Invalid credentials." }响应，你可以_有一些_信心地说你实际上并没有到达API本身，而是到达了它前面的某些东西（尽管不能保证，因为再次取决于外部服务的配置）。
英文:
Simply because you got back a message doesn't necessarily mean you are reaching the specified endpoint. It is going to depend on the setup of the external web service.
For example, a web API that I work on and maintain uses AWS API Gateway with a AWS lambda token authorizer in front of it. All requests first go through this authorizer to see if they have valid credentials supplied. If not, the authorizer will return back a 401 Unauthorized message, not our actual web API that is trying to be reached. This is why you can't assume you are actually reaching the API with a test like this, since its not clear if the service itself it performing the validations, or something else.
You can sort of test this by trying some bogus endpoints out and seeing what you get as a response. If you try a valid endpoint you know exists and then a bogus one that doesn't exist, if you get back the same 400 { "message": "Invalid credentials." } response, you can say with some confidence that you aren't actually reaching the API itself, but rather something in front it (its not guaranteed though since again, it depends on how the external service is configured).
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论