Detecting HTTP Status Code Misuses in REST APIs via Static and Dynamic Analysis

2026-09-11

AI Summary

本文通过静态和动态分析方法检测REST API中HTTP状态码的误用问题，基于2625个实际API规范制定了30条使用规则，并实现工具来识别违规情况。

Abstract

REST APIs are widely used on the web for client-server communications. As REST is based on HTTP, server responses contain status codes to indicate the outcome of requests (e.g., 200 OK for a success and 404 Not Found for an unavailable resource). While HTTP status codes are standardized, their semantics are not enforced in REST, leading to many misuses in practice (e.g., using 500 Internal Server Error to describe a client error). Such misuses may have nefarious consequences, such as reducing interoperability, misleading API clients, or causing false positives in testing tools. In this paper, we present a combined static and dynamic analysis approach for detecting HTTP status code misuses in REST APIs. We first study 2,625 real-world REST API specifications to identify relevant status codes and derive a set of 30 usage rules based on HTTP standards and REST API principles. We then implement tools to identify such rule violations in OpenAPI specifications (static analysis) and in API behavior (dynamic analysis). Our evaluation finds that status code misuses are frequent and systematic in REST APIs, with both static and dynamic approaches detecting various misuses. We highlight that both approaches may be used in a complementary manner, and also provide insight for REST API testers and users alike.

Problem

• HTTP Status Codes
• REST APIs
• Misuses
• Interoperability
• Testing Tools

Innovation

• static and dynamic analysis
• HTTP status code misuses
• REST APIs
• OpenAPI specifications