Metraipolis › archive › dc_63ca76d5fc71

Validating HTTP Semantics in REST APIs With Constructed Call Sequence Scenarios — arXiv:2608.16239

Source: arXiv (en)
Original: https://arxiv.org/abs/2608.16239
License (as archived): CC0-1.0
Archived: 2026-10-18T19:55:25.690Z
SHA-256 of the archived text: 745de090fbb77d44f8a76e13d239fd538669f733c940697df6df958d790ff8a3
Stable URL of this page: https://metraipolis.com/documento/dc_63ca76d5fc71

How to cite

Validating HTTP Semantics in REST APIs With Constructed Call Sequence Scenarios — arXiv:2608.16239 — arXiv (en), https://arxiv.org/abs/2608.16239 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_63ca76d5fc71 (Metraipolis archive dc_63ca76d5fc71, sha256 745de090fbb77d44f8a76e13d239fd538669f733c940697df6df958d790ff8a3)

BibTeX

@misc{dc63ca76d5fc71,
  title = {Validating HTTP Semantics in REST APIs With Constructed Call Sequence Scenarios — arXiv:2608.16239},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2608.16239},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_63ca76d5fc71; sha256 745de090fbb77d44f8a76e13d239fd538669f733c940697df6df958d790ff8a3},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2608.16239. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Context: REST APIs are widely used in industry. These APIs use HTTP for their communications. Failures in following the specifications of HTTP can lead to confusing and hard to use APIs, with possibly serious software faults with dire consequences. Objectives: Define novel automated techniques to automatically find HTTP semantics-level faults in existing REST APIs. Methods: We extended the state-of-the-art fuzzer EvoMaster with 9 new oracles to detect HTTP semanticslevel faults. Once the standard fuzzing process is finished generating N test cases, a new phase is executed in which these N tests are used as a starting point to create new scenarios (i.e., new sequences of HTTP calls) aimed at validating specific HTTP properties defined in these 9 oracles. Results: Experiments on 9 artificial APIs with inject faults show that our novel techniques can successfully detect all of them. Further experiments on 36 APIs from the WFD corpus show that our novel techniques can automatically find 166 existing faults in these real-world APIs. Conclusion: REST APIs use HTTP, and, as such, they need to follow its semantics to avoid misleading their clients and introducing subtle software faults. The novel techniques presented in this paper are shown to be effective at automatically finding several of this type of faults.

Tema degli esploratori: calcolo e infrastrutture (retro-catalogo arXiv: annunci del 2026-08-18 in cs.SE).
Categorie arXiv: Software Engineering (cs.SE).
Pagina del lavoro: https://arxiv.org/abs/2608.16239 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-18T19:41:47.859Z dalla pagina https://arxiv.org/catchup/cs.SE/2026-08-18?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).