GET /method

An endpoint that claims (via Allow or OPTIONS) to support GET/POST/PUT/PATCH/DELETE/OPTIONS but only actually handles GET. The chaos varies by mode: lying Allow header, silent success on wrong method, 405 without Allow, or OPTIONS that contradicts reality.

mode lying-allow (default; Allow header claims six methods, only GET works), silent-on-wrong-method (non-GET returns 200 with empty body — looks like success), 405-without-allow (405 with no Allow header, violates RFC 9110), options-mismatch (OPTIONS advertises six methods; real handler accepts only GET).

build a request:

method flaw

expect: GET always returns 200 with explanatory JSON. Non-GET methods surface the lie per mode: 405 with a misleading Allow header, 200 with an empty body, 405 without an Allow header (RFC violation), or 405 contradicting an earlier OPTIONS. The try-it button only sends GET; use the bash example to send POST/PUT and see the chaos.

bash

# GET is the only method that actually works — fire each method to see how
# the chaos surfaces in the chosen mode
for method in GET POST PUT PATCH DELETE OPTIONS; do
    code=$(curl -s -o /dev/null -w '%{http_code}' -X "$method" 'https://chaos.catastrophic.io/method?mode=lying-allow')
    echo "$method -> $code"
done

import urllib.request, urllib.error
for method in ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]:
    req = urllib.request.Request("https://chaos.catastrophic.io/method?mode=lying-allow", method=method)
    try:
        resp = urllib.request.urlopen(req)
        print(f"{method} -> {resp.status} (Allow: {resp.headers.get('Allow')})")
    except urllib.error.HTTPError as e:
        print(f"{method} -> {e.code} (Allow: {e.headers.get('Allow')})")

for (const method of ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]) {
    const res = await fetch("https://chaos.catastrophic.io/method?mode=lying-allow", { method });
    console.log(`${method} -> ${res.status} (Allow: ${res.headers.get("allow")})`);
}

package main

import (
    "fmt"
    "net/http"
)

func main() {
    client := &http.Client{}
    for _, m := range []string{"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"} {
        req, _ := http.NewRequest(m, "https://chaos.catastrophic.io/method?mode=lying-allow", nil)
        resp, _ := client.Do(req)
        fmt.Printf("%s -> %d (Allow: %s)\n", m, resp.StatusCode, resp.Header.Get("Allow"))
        resp.Body.Close()
    }
}

// Cargo.toml: reqwest = { version = "0.12", features = ["blocking"] }
use reqwest::Method;
fn main() -> Result<(), Box> {
    let client = reqwest::blocking::Client::new();
    for m in [Method::GET, Method::POST, Method::PUT, Method::PATCH, Method::DELETE, Method::OPTIONS] {
        let resp = client.request(m.clone(), "https://chaos.catastrophic.io/method?mode=lying-allow").send()?;
        println!("{} -> {} (Allow: {:?})", m, resp.status(), resp.headers().get("allow"));
    }
    Ok(())
}

import java.net.URI;
import java.net.http.*;

public class MethodChaos {
    public static void main(String[] args) throws Exception {
        var client = HttpClient.newHttpClient();
        for (var m : new String[]{"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"}) {
            var req = HttpRequest.newBuilder(URI.create("https://chaos.catastrophic.io/method?mode=lying-allow"))
                .method(m, HttpRequest.BodyPublishers.noBody())
                .build();
            var resp = client.send(req, HttpResponse.BodyHandlers.discarding());
            System.out.printf("%s -> %d (Allow: %s)%n",
                m, resp.statusCode(),
                resp.headers().firstValue("Allow").orElse(""));
        }
    }
}

using var client = new HttpClient();
foreach (var m in new[] { "GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS" })
{
    var req = new HttpRequestMessage(new HttpMethod(m), "https://chaos.catastrophic.io/method?mode=lying-allow");
    var resp = await client.SendAsync(req);
    resp.Headers.TryGetValues("Allow", out var allow);
    Console.WriteLine($"{m} -> {(int)resp.StatusCode} (Allow: {allow?.FirstOrDefault()})");
}

require "net/http"
uri = URI("https://chaos.catastrophic.io/method?mode=lying-allow")
Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
    %w[GET POST PUT PATCH DELETE OPTIONS].each do |m|
        req_class = Net::HTTP.const_get(m.capitalize)
        res = http.request(req_class.new(uri))
        puts "#{m} -> #{res.code} (Allow: #{res['Allow']})"
    end
end

'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS' | ForEach-Object {
    try {
        $r = Invoke-WebRequest -Uri 'https://chaos.catastrophic.io/method?mode=lying-allow' -Method $_
        "$($_) -> $($r.StatusCode) (Allow: $($r.Headers['Allow']))"
    } catch {
        $r = $_.Exception.Response
        "$($_) -> $([int]$r.StatusCode) (Allow: $($r.Headers['Allow']))"
    }
}