HTTP Fundamentals for API Testing

#HTTP Methods, Headers, and Status Codes#link

APIs communicate over HTTP. Understanding the protocol deeply is essential for identifying misconfigurations, authentication weaknesses, and data exposure.

Critical HTTP Methods

GET    /api/users       # Read resources
POST   /api/users       # Create resource
PUT    /api/users/1     # Replace resource
PATCH  /api/users/1     # Partial update
DELETE /api/users/1     # Delete resource
OPTIONS /api/users      # Check allowed methods

Security-Relevant Headers

Headers like Authorization, X-API-Key, Cookie, and CORS headers (Access-Control-Allow-Origin) are critical attack surfaces. Missing security headers like X-Content-Type-Options or misconfigured CORS policies are common findings.