TL;DR Is it a "best practice" to return an HTTP 400 Bad Request response if extra parameters are sent with a request?
I'm putting together a web app and doings some testing with OWASP ZAP. I'm pretty happy with the results - the errors I get seem to be all low confidence and when I inspect the errors in detail, I'm finding that the ZAP tool really didn't change anything with the request. But that leads me to a "higher level" question, which is best explained with an example:
OWASP ZAP allegedly found an SQL injection with the following URL:
in "human-readable" form, that is:
http://example.com/api/client/1?query=query' AND '1'='1' --
Looks like a pretty standard SQL injection attack. Now, this endpoint is intended to return a
client object in JSON form, and that's what this request does through OWASP ZAP. The server returned exactly what was expected, the client with ID=1. I'm doing everything that the OWASP ZAP docs recommend with respect to SQL injections, so what more should I do?
It occurs to me that I just don't know what OWASP ZAP expects to receive in response to this kind of attack - an error reponse, perhaps? The docs are helpful, in a "this is how to interface with the database" kind of way, but it's not clear to me if I need to respond with an error.
Should I return a 400 Bad Request error if inappropriate query parameters are provided?