operation-2xx-response rule should not be recommended

[krystof-k]

I suggest to move operation-2xx-response rule out from recommended, as it is reasonable to have endpoints that have no success response but only 3xx redirects. Or maybe change the rule to allow 2xx or 3xx responses.

What do you think?

[philsturgeon]

@krystof-k hey there! Could you explain the use case a little more? What is happening with your API where only 3xx is coming out of it? I seem to remember the YouTube API used to do this, where a successful POST would then say "this worked out and you should follow to the Location to get the content" but this always struct as a weird choice. 204 with a Content-Location would be more correct.

If you want room to be creative, you can turn that rule off, but maybe there is a legit use case I'm forgetting and you could help remind me!

[krystof-k]

We use it for forwarding to pre-signed URL on AWS S3. Client requests GET /files/{file ID} and if authorized, server generates the URL and sends Location: https://bucket.s3.amazonaws.com/file.ext?X-Amz-Signature=blabla header in the response.

Not sure whether this is a best practise, I was doing some research and the only thing I found was Microsoft OneDrive, but maybe there is a better way to do it :)

[philsturgeon]

Ahh nice use case.

Ok, let's change this rule from operation-2xx-response to operation-success and look for anything starting with a 2 or a 3.

[krystof-k]

Cool! :)

BTW thanks for mentioning Content-Location header, seems I'm using the Location header for newly created object in 201 Created response wrong :)