POST request to security advisories API gets 404 error

[GuySartorelli]

A GET request to https://packagist.org/api/security-advisories/ works exactly as expected, but a POST request gets a 404 error.
It looks like the API should support POST requests, even if it's not documented in the apidoc.

I want to send a POST request because any GET request with too many packages fails (gets a 502 error, most likely hitting the limit of characters that can be included in get vars). Even a project with a fairly modest number of packages can't currently request advisories for all of its packages in a single request, and I'd rather not spam the API with lots of requests for a single project's package list.

[glaubinix]

@GuySartorelli can you show how you trigger the POST request? This should definitely work, see for example curl -X POST -F 'packages[]=symfony/http-foundation' https://packagist.org/api/security-advisories/

[GuySartorelli]

Yup. The code I'm using is in composer/composer#10798 - I'll include the relevant parts here for convenience:

use Composer\Factory;

$opts = [
    'retry-auth-failure' => false,
    'http' => [
        'method' => 'POST',
        'header' => array('Content-Type: application/json'),
        'content' => json_encode(['packages' => $packageNames]),
    ],
];

// `$this` in this context is a command
$composer = $this->getComposer(true);
$httpDownloader = Factory::createHttpDownloader($this->getIO(), $composer->getConfig());
$response = $httpDownloader->get('https://packagist.org/api/security-advisories', $opts);

Sounds like there's probably something wrong with my code rather than something wrong with packagist though.

[glaubinix]

Two things:

• You are missing a slash at the end of the URL which causes the 404
• Packagist currently doesn't check and decodes the body content for package names so using application/json won't work

The below code should work:

$response = $httpDownloader->get('https://packagist.org/api/security-advisories/', [
    'retry-auth-failure' => false,
    'http' => [
        'method' => 'POST',
        'header' => array('Content-type: application/x-www-form-urlencoded'),
        'content' => http_build_query(['packages' => ['symfony/http-foundation']]),
    ],
]);

[GuySartorelli]

Huh. I wouldn't have expected a trailing slash being ommitted would cause a 404... but there ya go haha. Thank you very much!