🐉 Boss: the lost pigeon

Exercise 6 of 6 in chapter 5 · 280 XP · 4 objectives checked by tests

Topics covered: DebuggingFirewall#[Groups]Data leak

Pippin is back from a crash course, “Scrolls in three days”. He has “simplified” a thing or two in the API.

Since then, the tavern's pigeons have been flying in circles:

Your mission

Three bugs are hiding in the API. Find them and fix them, without breaking anything else.

Detective method

  1. Reproduce each symptom with the Requests tab: the status code, the headers (Location!) and the body tell you a lot.
  2. One bug can hide another: as long as the reservation fails, you can't see what its response contains. Fix, then send the request again.
  3. For an API, a response that works isn't necessarily a good response. Read it in full: what should never have been in there?

The Circle of Mages has already sent a raven to complain. And ravens peck.