vaimee / zion

A scalable Thing Description Directory
Apache License 2.0
17 stars 4 forks source link

MIssing check on PUT /things/{id} (create) to prevent a different id in the body #13

Closed hyperloris closed 2 years ago

hyperloris commented 2 years ago

When a new TD is created via the PUT /things/{id} endpoint, it is possible to pass two different ids between the one in the URL and the one in the body. This creates a situation where the user will receive a 404 Not Found if they subsequently try to retrieve the TD via the id in the descriptor.

If we take a look at the documentation it becomes clear to me that this situation should not be possible:

A TD that has an id MUST be submitted to the directory in the body of an HTTP PUT request at /things/{id} endpoint, where id is the unique TD identifier, present inside the TD object.