DHIVA LABS · LEARN

Appearance

Auth, CORS and project settings ​

This page covers the auth check on an endpoint and the settings that apply to a whole project: port, CORS, global delay and global headers.

Require an auth header ​

An endpoint can insist that requests carry a credentials header. Requests without it get 401 Unauthorized instead of your responses. Use it to test the logged-in and logged-out paths of your app.

  1. Open the endpoint and expand Advanced settings below the responses.

  2. Under Authentication, turn on Require an auth header (returns 401 if missing).

  3. In Required header name, keep Authorization, or type the header your API uses, such as X-API-Key.

The Protected endpoint template creates GET /me with this already turned on.

What the check does ​

  • It passes when the request has the named header with any non-empty value. The header name is not case-sensitive.
  • It does not check the value. Authorization: Bearer anything is accepted. This is a mock of the rule "you must send credentials", not a real login.
  • It runs before a response is chosen, so it applies whichever strategy the endpoint uses.

A request without the header gets status 401 and this body, with the header name you set:

json
{
  "error": "unauthorized",
  "message": "Missing Authorization header"
}

In the Live section the request shows the note Auth required. The 401 is sent at once, without the endpoint's delay.

bash
# Rejected: 401
curl -i http://localhost:8080/me

# Accepted
curl -i http://localhost:8080/me -H 'Authorization: Bearer test-token'

The built-in tester adds the required header for you, so Send always passes the check. Use curl or your app to see the 401.

Check the value too ​

To accept one token and reject others, combine the switch with conditional rules:

LabelConditionsStatus
ProfileHeader Authorization equals Bearer good-token200
Wrong tokennone (fallback)403

A missing header gets the built-in 401, a wrong token gets your 403, and the right token gets the 200. For background on auth schemes, see Auth basics and Auth testing.

Project settings ​

Select Project in the rail. The page has four parts: Server, Proxy passthrough, Global response settings and Storage. Changes are saved as you make them.

Port ​

Port is the number in the mock's address: port 8080 gives http://localhost:8080.

  • Pick a number from 1024 to 65535 that no other program uses.
  • The port can only change while the server is stopped. While it runs, the field reads Stop server to change.
  • Each project needs its own port if you want to run several at once. A new project is given the next free number automatically.

If the port is taken, starting the server shows Port 8080 is already in use. Pick another port.

Enable CORS ​

Browsers block a web page from calling a server at a different address unless that server says it is allowed. This rule is called CORS, cross-origin resource sharing. A web app served from http://localhost:3000 that calls a mock on http://localhost:8080 needs the mock to allow it.

Enable CORS is on by default. While it is on:

  • every response carries these headers:

    http
    access-control-allow-origin: *
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD
access-control-allow-headers: *
access-control-max-age: 86400

  • every OPTIONS request is answered by the server itself with status 204 and those headers. Browsers send such a "preflight" request before some calls. It appears in the Live section with the note CORS preflight.

Because the server answers all OPTIONS requests while CORS is on, an endpoint with the method OPTIONS is only reached when Enable CORS is off.

Turn CORS off to test how your web app behaves when an API does not allow it. Tools such as curl, mobile apps and server-side code ignore CORS, so the setting makes no difference to them.

Global delay ​

Global delay (ms) adds a wait to every response from your endpoints, on top of each endpoint's own delay. Use it to see how the whole app copes with a slow network. Replies the server makes itself (the 404 for an unknown path, the auth 401, preflight replies) and proxied replies are not delayed. Latency and faults explains how the delays add up.

Global headers ​

Under Global headers (added to every response), select Add and fill in Header name and Value. The header is then sent with every reply from your endpoints, and with the server's own 404, 401 and preflight replies. Proxied replies do not get global headers.

Typical uses:

HeaderValueWhy
Cache-Controlno-storeStop a browser or client caching mock replies
X-MocktrueLet your app or logs tell mock traffic from real traffic
X-API-Version2Imitate a header the real API always sends

Global header values are sent exactly as typed. Placeholders such as {{uuid}} are only filled in on a response's own headers; see Responses.

Proxy passthrough ​

Forward unmatched requests to (base URL) and Record proxied responses let the mock stand in front of a real API. They have their own page: Proxy and record.

Storage ​

Storage shows the path of the JSON file this project is saved in. See Projects, files and Git.

Next steps ​