API & Auth Chaos
Inject semantic HTTP faults, corrupt JSON payloads, and disrupt auth tokens mid-flight via ApiChaosEngine.
Usage
bash
loki run http://localhost:8000 --persona network-tormentor --api-chaos --fault-rate 0.5 --auth-chaosloki run http://localhost:8000 --swarm --no-auth-chaos
Active personas
ApiChaosEngine attaches during network-tormentor, swarm (--swarm), and all runs when --api-chaos is enabled (on by default).
API fault types (`--api-chaos`, `--fault-rate`)
| Flag | Type | Default | Description |
|---|---|---|---|
| status_code | fault_type | 500, 502, 503, 504 | Fulfills the intercepted request with a synthetic 5xx JSON error payload. |
| corrupt_json | fault_type | on | Fetches the real response and recursively mutates JSON values (null, "NaN", -999999, boolean inversion, empty arrays, and monster strings). |
| delay | fault_type | 1500–3500 ms | Injects random latency (delay_range_ms) before fulfilling the real response. |
| empty_response | fault_type | 200 {} | Fulfills the request with HTTP 200 and an empty {} JSON object. |
| schema_strip | fault_type | 1–2 keys | Strips 1–2 keys from the real JSON response (or empties arrays) to expose missing optional chaining (?.). |
Auth & session faults (`--auth-chaos`)
| Flag | Type | Default | Description |
|---|---|---|---|
| token_invalidation | auth_fault_type | in-flight | Strips sensitive authentication headers (Authorization, X-API-Key, etc.) from outgoing requests in-flight. |
| token_corruption | auth_fault_type | in-flight | Replaces sensitive auth headers in-flight with Bearer loki_corrupted_expired_token_signature_invalid. |
| 401_unauthorized | auth_fault_type | HTTP 401 | Fulfills authenticated requests with a synthetic 401 Unauthorized JSON payload (AUTH_TOKEN_EXPIRED). |
| 403_forbidden | auth_fault_type | HTTP 403 | Fulfills authenticated requests with a synthetic 403 Forbidden JSON payload. |
| cookie_eviction | session | mid-run | Clears all browser context cookies mid-session (evict_session_cookies) and checks for blank screens, infinite spinners, or unmounted #root/#app containers. |