Hi, I'm having issues coding an app in node.js aga...
# fleetj
J.R. Murray
07/27/2023, 5:35 PMHi, I'm having issues coding an app in node.js against the Fleet API. The Run Queries endpoint spec shows a GET with a JSON payload, which is against HTTP spec and node is actively refusing to do it.
k
Kathy Satterlee
07/27/2023, 5:59 PMHey @J.R. Murray. You might have better luck getting advice in a Node space, but I'm happy to see if I can help. What package are you using to handle requests? It should certainly be doable. While sending a body in
GETj
J.R. Murray
07/27/2023, 6:01 PM@Kathy Satterlee thanks for the response. I would say it's contentious at best. https://github.com/node-fetch/node-fetch/pull/795
J.R. Murray
07/27/2023, 6:01 PMJ.R. Murray
07/27/2023, 6:01 PMthe error is
Request with GET/HEAD method cannot have bodym
mikermcneil
07/27/2023, 6:05 PMWe can def help you here. cc @Eric Shaw @Rachael Shaw
mikermcneil
07/27/2023, 6:07 PMWhile sending a body inđŻ Agreed. Also found this weird. Here's how I implemented it in Node recently: (The TODO on line 167 can be ignored-- it turned out to be all good. I was just a little thrown off like you.)is unconventional, it isn't prohibited by spec.GET
j
J.R. Murray
07/27/2023, 6:09 PMWe are using this as part of a security automation framework we're building... I don't think replacing the whole http architecture with
sailsm
mikermcneil
07/27/2023, 6:10 PMDef wouldn't suggest that! Just sharing as an example of working code- feel free to implement it however you like.
mikermcneil
07/27/2023, 6:14 PMWould you be able to share some code?
mikermcneil
07/27/2023, 6:16 PM@koo might also have ideas
j
J.R. Murray
07/27/2023, 6:17 PMI can't share any code. Not that I don't want to, it's just complex and sprawled across a lot of files and functions. It's react in node.js.
J.R. Murray
07/27/2023, 6:17 PMhonestly I'd just like another means to run a live query besides a get request, or to use the url query string for them
J.R. Murray
07/27/2023, 6:18 PMas it is, you can't put fleet behind varnish because it ignores any get payload and treats all of the requests the same
m
mikermcneil
07/27/2023, 6:25 PM100% agree. And also re querystring. But as a short term workaround, how about switching to require(ârequestâ) or a different package, even if itâs just for this call? Want to make sure youâre unblocked. (We have a 3 week release cycle, except for security patches, and features get prioritized during the 3 weeks before the start of each sprint)
If youâd like to contribute, an awesome immediate way could be to PR the API docs (âEdit this pageâ) and propose the API change to the docs themselves, with the context in this convo (where I think youâve stated the problems with the current design very clearly and concisely)
We need to take semver into account, but I think itâs doable in a backwards compatible way.
Maybe we get that far, then Rachael (DRI) can review, and Kathy or Rachael can bring this up for prioritization at the next feature fest.
Sound ok to you?
j
J.R. Murray
07/27/2023, 6:26 PMI'm ok with waiting 3-4 weeks for a fix. Having a working integration would be nice but I don't want to make a bunch of one-off code in a general-purpose solution. Not to mention I'm not really the developer đ
J.R. Murray
07/27/2023, 6:28 PMthe code to make the request itself is relatively simple.
Copy code
response = await fetch(fetchUrl, {
method: fetchMethod,
headers: fetchHeaders,
body: fetchBody
})m
mikermcneil
07/27/2023, 6:28 PMTo be clear: more like 6 weeks, if the CX group is able to prioritize it. I think the doc PR helps, since we can get that design worked out first asap; then itâs less scary to prioritize quickly
mikermcneil
07/27/2023, 6:31 PMAlso, super glad you brought this up. Itâs a weird design that in retrospect should have been different, but didnât realize you couldnât do this kind of request in the most popular http client for at least one language. Def makes it more of a priority. cc @Rachael Shaw BOTL for a proposal
j
J.R. Murray
07/27/2023, 6:33 PMok, that helps. Thank you đ
k
Kathy Satterlee
07/27/2023, 6:36 PMGreat stuff y'all, thanks!
j
J.R. Murray
07/27/2023, 6:37 PMdoes someone have a github link for the api docs?
k
Kathy Satterlee
07/27/2023, 6:42 PMKathy Satterlee
07/27/2023, 6:44 PMYou can also hit the "Edit Page" button from the website on any page in the docs to be dropped right into and edit session on GitHub đ
j
J.R. Murray
07/27/2023, 6:53 PMneato
J.R. Murray
07/27/2023, 7:02 PMJ.R. Murray
10/27/2023, 5:57 PM@Kathy Satterlee @mikermcneil have there been any updates on this?
m
mikermcneil
10/27/2023, 6:01 PM@Noah Talerman @Rachael Shaw this API design decision was something I disagreed and committed on. It is possible to work around, but just weird and an easy change. I continue to disagree and Iâm hearing users have the challenge.
j
J.R. Murray
10/27/2023, 6:02 PMFYI I just read that OpenAPI removed support for describing
GETm
mikermcneil
10/27/2023, 6:03 PMAs they should
j
J.R. Murray
10/27/2023, 6:03 PMapparently they quietly added it back into 3.1 after getting some pushback ... but yeah
m
mikermcneil
10/27/2023, 6:04 PMJust a matter of timing. Should be a relatively small change, but would you be up for making a PR, JR?
j
J.R. Murray
10/27/2023, 6:04 PMI did a PR on the docs, we have too many backlogged items in our own app for me to commit to that.
m
mikermcneil
10/27/2023, 6:14 PMI know the feeling
FYI about the PR @Noah Talerman for feature fest.