Postman中防止生产环境破坏性API调用的最佳实践及确认提示方案

Got it, let's work through this problem—since Postman doesn’t have a native prompt() function for pre-request scripts, we need to get creative with the tools we do have. Here are four practical workarounds tailored to your scenario of multiple environments and frequent environment switching:

1. Visualizer + Manual Confirmation Flow #

This is a lightweight, user-friendly approach that leverages Postman’s Visualizer to create a custom confirmation prompt before executing dangerous requests in production.

How to set it up: #

• First, tag your dangerous APIs: Add a custom header like X-Dangerous-API: true to all destructive requests (or use URL path patterns like /delete to identify them).
• Add this Pre-request Script to your collection or individual requests:

  // Check if we're in Production and targeting a dangerous API
  const isProd = pm.environment.get("ENV_NAME") === "Prod";
  const isDangerous = pm.request.headers.get("X-Dangerous-API") === "true";
  
  if (isProd && isDangerous) {
      pm.environment.set("needs_confirmation", "true");
      // Modify the request to mark it as pending confirmation
      pm.request.url.addQueryParams("confirm", "pending");
  } else {
      pm.environment.set("needs_confirmation", "false");
  }
  

• Add this Test Script to the same scope:

  if (pm.environment.get("needs_confirmation") === "true") {
      const confirmationUI = `
          <div style="padding:24px; background:#fff3f3; border-radius:8px; border:1px solid #ffcccc;">
              <h3 style="color:#dc3545;">⚠️ PRODUCTION DANGER</h3>
              <p>You're about to run a destructive API call in Production. Type <strong>CONFIRM</strong> below to proceed:</p>
              <input type="text" id="confirmInput" style="margin:12px 0; padding:8px; width:200px; border-radius:4px; border:1px solid #ddd;">
              <button onclick="confirmRequest()" style="padding:8px 16px; background:#dc3545; color:white; border:none; border-radius:4px; cursor:pointer;">Execute Request</button>
          </div>
          <script>
              function confirmRequest() {
                  const input = document.getElementById('confirmInput').value.trim();
                  if (input === 'CONFIRM') {
                      // Resend the request with confirmation flag set
                      const updatedUrl = pm.request.url.toString().replace('confirm=pending', 'confirm=true');
                      pm.sendRequest({
                          url: updatedUrl,
                          method: pm.request.method,
                          headers: pm.request.headers,
                          body: pm.request.body
                      }, (err, res) => {
                          pm.visualizer.set(res.json());
                      });
                  } else {
                      alert('Invalid confirmation. Request cancelled.');
                  }
              }
          </script>
      `;
      pm.visualizer.set(confirmationUI);
      // Block the original request from returning a result
      pm.test("Request paused for production confirmation", () => {
          throw new Error("Please confirm via the Visualizer tab to execute this request.");
      });
  }
  

• How it works: When a developer sends the request, it gets intercepted by the Test script, which displays a confirmation UI in the Visualizer tab. Only after entering the correct code does the actual request execute.

2. Environment Variable-Based Token Confirmation #

This adds a layer of authorization by requiring developers to enter a short-lived confirmation token before running dangerous production requests.

How to set it up: #

• In your collection’s Pre-request Script, add:

  const isProd = pm.environment.get("ENV_NAME") === "Prod";
  const isDangerous = pm.request.method === "DELETE" || pm.request.url.path.includes("destroy"); // Adjust based on your APIs
  
  if (isProd && isDangerous) {
      const currentToken = pm.environment.get("prod_confirm_token");
      const tokenExpiry = pm.environment.get("prod_token_expiry");
      const now = Date.now();
  
      // Check if token is missing or expired (10-minute validity)
      if (!currentToken || (tokenExpiry && now > tokenExpiry)) {
          throw new Error("⚠️ Production Dangerous API: Please set the 'prod_confirm_token' environment variable with a valid code (ask your admin for it). Tokens expire after 10 minutes.");
      }
  
      // Attach the token to the request for backend validation (optional)
      pm.request.headers.add({ key: "X-Prod-Confirm-Token", value: currentToken });
      // Reset expiry to extend validity
      pm.environment.set("prod_token_expiry", now + 10 * 60 * 1000);
  }
  

• How it works: Admins can generate one-time or short-lived tokens. Developers have to manually add this token to their environment variables to proceed, creating an explicit confirmation step without blocking access entirely.

3. Monitor + Approval Workflow (For High-Risk Operations) #

If you want to restrict direct execution of dangerous production APIs, use Postman Monitors with an approval step.

How to set it up: #

• Move all dangerous production requests to a dedicated collection.
• Configure a Postman Monitor for this collection, but set it to run only on demand (via webhook or manual trigger).
• When a developer needs to run the request, they send a request to the monitor’s webhook endpoint (with necessary parameters) and notify an admin for approval.
• The admin verifies the request and manually triggers the monitor to execute it.
• How it works: This removes direct execution capability from developers, ensuring high-risk actions are reviewed before being run.

4. Custom Postman Extension (Advanced) #

If your team has development resources, build a custom Postman extension to add native-style confirmation prompts. Postman supports third-party extensions that can hook into request execution flows and display custom UI dialogs.

How to set it up: #

• Use Postman’s Extension SDK to create an extension that listens for request send events.
• Add logic to check if the request is a dangerous API in production, then display a native confirmation dialog.
• Only proceed with the request if the user confirms.
• How it works: This provides the most seamless user experience, with a native prompt similar to what you’d get from a prompt() function.

Choose the approach that best fits your team’s risk tolerance and workflow:

• For quick, lightweight confirmation: Go with the Visualizer flow (Option 1).
• For a balance of control and flexibility: Use the token-based system (Option 2).
• For strict, auditable approval: Implement the monitor workflow (Option 3).
• For a polished, native experience: Build a custom extension (Option 4).

内容的提问来源于stack exchange，提问作者rquinn