Diego Rodrigues de Sa e Souza 6f41775a1c fix(security): 405 method-first for /api/keys/{id}/devices (dast-smoke QUERY check) ...

Schemathesis's newer unsupported-methods check (unpinned tool drift) sends
QUERY /api/keys/{id}/devices and demands 405 Method Not Allowed; the path had
no HIGH_RISK_METHOD_RULES entry, so the auth layer answered 401 first. Add
the devices rule (GET-only) so undocumented methods get a clean method-first
405 — same pattern as the v3.8.44 TRACE fix. TDD:
tests/unit/dast-method-not-allowed.test.ts gains the devices QUERY case (4/4).

2026-07-05 21:19:43 -03:00

3.1 KiB

Raw Permalink Blame History

View Raw