My Tests Agreed With My Code. Neither of Them Checked Reality
I had twenty-two passing tests and two separate reviewers on a piece of code. None of it objected. Then I pointed it at a real API owned by somebody else and it broke on the first live read. The mismatch fit in one sentence: my parser required ISO 8601, the documented API returned Unix seconds. The repair was not one line. It touched five files, 74 lines of parser and 52 lines of tests. The…
My tests and code both showed success, yet they failed to verify the real-world outcome. After passing twenty-two tests and receiving two separate reviews, the code broke upon interacting with an external API. The issue stemmed from a discrepancy between the ISO 8601 format required by the parser and the Unix seconds format returned by the API.
Fixing the problem proved more complex than anticipated, as it required modifications to five files, totaling 74 lines of parser code and 52 lines of tests. The root cause of the failure lay in the assumption that both the tests and the code consistently used the ISO format, which never challenged the reality of the situation. This oversight went unnoticed by two independent reviewers as well.
The second failure was even more severe. By redirecting the request, the issue became more apparent, highlighting the importance of the redirect containment mechanism. In Python 3.13, the default redirect handler inadvertently dropped certain headers, including the crucial X-API-Key. The workaround involved using the Request.add_unredirected_header() method, which marked specific headers as exempt from being added to redirected requests.
However, the developer had not implemented this solution. The issue was discovered through an independent integration test, which exposed the problem in a live environment. The discovery process involved collaborating with FIPSign (mobydickfinance), who provided disposable API keys for testing purposes. This collaboration allowed for a deeper examination of the API's handling of server-to-server calls and confirmed that API key authentication bypassed the CORS and origin policies.
To address the issue, the operator requested specific details such as the timestamp, HTTP client/library and version, network environment, and client user agent. Armed with this information, the developer provided Python-urllib/3.13, the default unmodified user agent for Python's urllib library. Additionally, the developer recommended setting a real user agent on the client, as it often helped bypass bot detection systems.
The developer emphasized the significance of conducting a controlled test to validate the fix, as a single run does not establish causation. However, the inclusion of the X-API-Key in the request receipt marked a significant milestone in resolving the issue. Despite the operator's confirmation that no changes were made to the endpoint, a discrepancy remained - the absence of the User-Agent field in the final receipt.
This omission created an uncontrolled gap in the timeline, making it impossible to establish a direct causal relationship between the header addition and the successful endpoint execution.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
