Mapping rules matching for GET vs POST

[mayorova]

Mapping rules defined in 3scale API Manager can have additional query parameters which are taken into account for mapping:

For GET requests it's very straightforward – the call:

curl -XGET "http://localhost:8080/test?key=hello&another=parameter"

will match the method get as expected.

But for POST the behavior is a bit strange. The reason is that for "non-GET" requests the "query parameters" are taken from the body.

So, this request will not match:

curl -XPOST "http://localhost:8080/test?key=hello" -d "another=parameter" 

while this one will match the pattern /test?key={value} (post method):

curl -XPOST "http://localhost:8080/test" -d "key=hello&another=parameter" 

I am trying to understand if this is by design, or this behavior should be change.
I'd say the current behavior is not intuitive, and would only be partly useful if application/x-www-form-urlencoded content type is used, as it will not work for JSON payloads for example.

I believe only actual query string needs to be taken into account for mapping rules matching.

[andrewdavidmackenzie]

Well, I'd say it's a "common" way to do it - like it's assuming form-urlencoded .... arguably it should depend on the content type and use the body or not, depending on that?

[mayorova]

arguably it should depend on the content type and use the body or not, depending on that?

Yes, probably this makes sense.

But then for requests like:

curl -XPOST "http://localhost:8080/test?key=hello" -H "Content-Type: application/json" -d '{"another":"parameter"}'

What would be the behavior? Should the request match or not the 2nd mapping rule?

[andrewdavidmackenzie]

I would say it would, as the URL+query parameters match the rule.

I'd consider the current behavior dubious - we need to understand if customers rely on this and "fixing it" would be a breaking change.

e.g. if content-type is form-url-encoded then match the rule against the URL plus the parameters in the body....otherwise use the url parameters only

[mikz]

I agree. If content-type is form-url-encoded, merge the body with the url params. Otherwise url params only.

[mikz]

Just the authentication parameters got fixed. This still has to be done for mapping rules.