Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
With the rise in usage of microservices, Making http requests is essential job of most devs. For these, there are multiple options like curl, insomnia postman. My Ideal choice is to use curl but problems with it is, having no history and no easy way to save and rerun. Postman solves that problem, but once user logs in(earlier it used to be optional, now its mandatory), it stores all request metadata(body/headers/urls/credentails) to their servers although it helps solve using it across multiple devices, backup but it could be potential security loop hole if they can access it. (now a days, postman desktop is super slow also).
This project aims to solve save&reuse requests, maintaining history and no sync in proprietery servers (although you can achive sync via commiting http files into git).
dothttp will provide simple, cleaner architecture for making http requests. It uses xtext (eclipse developed dsl) to build a custom dsl.
More information or docs can be cound at https://docs.dothttp.dev
Go through this example for better understanding. for babysteps click here
# users.http
#!/usr/bin/env /home/prasanth/cedric05/dothttp/dist/dothttp-cli
# this is comment
// this is also a comment
/*
this is multi line
comment
*/
# http file can have multiple requests, name tag/annotation is used to identify
@name("fetch 100 users, skip first 50")
# makes are get request, with url `https://req.dothttp.dev/user`
GET https://req.dothttp.dev/user
# below is an header example
"Authorization": "Basic dXNlcm5hbWU6cGFzc3dvcmQ="
# below is how you set url params '?' --> signifies url quary param
? ("fetch", "100") #
? ("skip", "50")
? projection, name
? projection, org
? projection, location
# makes are post request, with url `https://req.dothttp.dev/user`
POST https://req.dothttp.dev/user
basicauth('username', 'password')
/*
below defines payload for the post request.
json --> signifies payload is json data
*/
json({
"name": "{{name=adam}}", # name is templated, if spcified via env or property, it will be replaced
"org": "dothttp",
"location": "Hyderabad",
# "interests": ["exploring", "listening to music"],
})
# makes put request, with url `https://req.dothttp.dev/user/1`
PUT https://req.dothttp.dev/post
# define headers in .dothttp.json with env
basicauth("{{username}}, "{{password}}")
# posts with urlencoded
data({
"name": "Adam A",
"org": "dothttp",
"location": "Hyderabad",
"interests": ["exploring", "listening to music"],
})
// or use below one
// data('name=Adam+A&org=dothttp&location=Hyderabad&interests=%5B%27exploring%27%2C+%27listening+to+music%27%5D')
pip install dothttp-req==0.0.10
git clone git@github.com:cedric05/dothttp.git
cd dothttp
python3 -m pip install pipenv
pipenv install
python3 -m dothttp examples/dothttpazure.http
docker build -t dothttp .
docker run -it --rm dothttp
docker run -it --rm dothttp
docker build -t dothttp .
whalebrew install dothttp
dothttp examples/dothttpazure.http
GET "http://localhost:8000/get"
dothttp get.http
or python -m dothttp get.http
dothttp simple.http
prints
{
"args": {},
"headers": {
"Accept-Encoding": "identity",
"Host": "httpbin.org",
"User-Agent": "python-urllib3/1.26.3",
"X-Amzn-Trace-Id": "Root=1-6022266a-20fb552e530ba3d90c75be6d"
},
"origin": "117.216.243.24",
"url": "http://localhost:8000/get"
}
POST "http://localhost:8000/post"
{
"args": {},
"data": "",
"files": {},
"form": {},
"headers": {
"Accept-Encoding": "identity",
"Content-Length": "0",
"Host": "httpbin.org",
"User-Agent": "python-urllib3/1.26.3",
"X-Amzn-Trace-Id": "Root=1-602228fa-3c3ed5213b6d8c2d2a223148"
},
"json": null,
"origin": "117.216.243.24",
"url": "http://localhost:8000/post"
}
similarly, other methodsGET, POST, OPTIONS, DELETE, CONNECT, PUT, HEAD, TRACE
support is available.
query params can be added to request by specifying
query ( "key", "value")
? "key", "value"
? "key": "value"
? "key"= "value"
all four are accepted. going with query("hi", "hi2)
is more readable. ?"key"= "value"
is more concise
user can specify payload by mentioning below four forms (for various scenarios).
data("ram")
user can also mention its content-type
with
data("ram", "text/plain")
data({"key": "value"})
for form input.
json({"key": "value"})
for json payload.
fileinput("path/to/file", "type")
uploads file as payload (type is optional).
files(("photo", "path/to/file/photo.jpg", "image/jpeg"), ("photo details", '{"name":"prasanth"}', "application/json") )
for multipart upload dothttp will figure out content type by going through file/data, when type is not mentioned.
dothttp will use #
for commenting entire line.
//
line comment. follows java, javascript#
line comment. follows python's comment style/* */
multi line comment. follows java/javascript stylePOST 'http://localhost:8000/post'
? ("{{key}}", "{{value}}")
data('{"{{key}}" :"{{value}}"}', 'application/json')
user can define environments and can activate multiple environments at a time
dothttp by default will read variables from "*"
section
for example
dothttp --property-file path/to/file.json --env ram chandra
will activate *
section properties, ram
section properties and chandra
section properties
dothttp --env ram chandra
will activate *
section properties, ram
section properties and chandra
section properties
from .dothttp.json
in httpfile name space
dothttp --property key=ram value=ranga
will replace {{ram}}
to ranga
from the filePOST 'https://{{host=httpbin.org}}/post'
User can define headers in below three formats
header('content-type', 'application/json')
readable'content-type': 'application/json'
conciseheaders
section from property-file can also be used. in most scenarios, headers section will be
common for a host. having them in property file would ease them.basicauth('username','password')'
--> will compute add respective headers.
digestauth('username','password')'
--> will compute add respective headers.
ntlmauth('username','password')'
--> will compute add respective headers.
{
"*": {
"host": "httpbin.org"
},
"headers": {
"content-type": "plain/text"
},
"preprod": {
"host": "preprod.httpbin.org"
}
}
*
section in property file will be activated once user specifies property file if user didn't specifiy file
and .dothttp.json
exists, it will be activatedheaders
once a property file is activated. headers from property file will be added to request by default without
user having to specify in .http
filedothttp can format a http file using below command
dothttp -fmt examples/dothttpazure.http --experimental
or
dothttp --format examples/dothttpazure.http --experimental
to print to command line
dothttp --format examples/dothttpazure.http --experimental --stdout
syntax highlighting for visual studio code is supported via dothttp-code
usage: dothttp [-h] [--curl] [--property-file PROPERTY_FILE] [--no-cookie] [--env ENV [ENV ...]] [--debug] [--info] [--format] [--stdout]
[--property PROPERTY [PROPERTY ...]]
file
http requests for humans
optional arguments:
-h, --help show this help message and exit
general:
--curl generates curl script
--no-cookie, -nc cookie storage is disabled
--debug, -d debug will enable logs and exceptions
--info, -i more information
file http file
property:
--property-file PROPERTY_FILE, -p PROPERTY_FILE
property file
--env ENV [ENV ...], -e ENV [ENV ...]
environment to select in property file. properties will be enabled on FIFO
--property PROPERTY [PROPERTY ...]
list of property's
format:
--format, -fmt formatter
--stdout print to commandline
checkout examples
FAQs
DotHttp recommended tool for making http requests.
We found that dothttp-req demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.