API Testing : Check API security

Verify that the API correctly handles API security and returns the correct resources for each API vulnerability.

Language: Java

Framework: Rest assured

copy
1/​/​Assuming the API endpoint is accessible from the local machine2/​/​and the API endpoint requires authentication token to access resources34import org.junit.Test;5import static io.restassured.RestAssured.given;67public class APITest {89 @Test10 public void testAPI() {11 /​/​Setting up base API endpoint URL12 given().baseUri("https:/​/​api.example.com")13 /​/​Setting up authentication token14 .auth().oauth2("INSERT_AUTH_TOKEN_HERE")15 /​/​Sending GET request to resource endpoint16 .when().get("/​resources")17 /​/​Verifying response status code18 .then().statusCode(200);19 } 2021/​/​Assuming a remote client with desired capabilities is available22/​/​to connect to the API endpoint for testing2324 @Test25 public void testAPIOnRemoteClient() {26 /​/​Specifying desired capabilities27 DesiredCapabilities capabilities = new DesiredCapabilities();28 capabilities.setCapability("deviceName", "INSERT_REMOTE_DEVICE_NAME_HERE");29 capabilities.setCapability("platformName", "INSERT_PLATFORM_NAME_HERE");30 capabilities.setCapability("platformVersion", "INSERT_PLATFORM_VERSION_HERE");31 /​/​Setting up remote API endpoint URL32 String remoteUrl = "https:/​/​INSERT_REMOTE_API_ENDPOINT_URL_HERE/​wd/​hub";33 /​/​Connecting to remote client with desired capabilities34 RemoteWebDriver driver = new RemoteWebDriver(new URL(remoteUrl), capabilities);35 /​/​Setting up base API endpoint URL36 RestAssured.baseURI = "https:/​/​api.example.com";37 /​/​Setting up authentication token38 RestAssured.authentication = RestAssured.oauth2("INSERT_AUTH_TOKEN_HERE");39 /​/​Sending GET request to resource endpoint40 given().when().get("/​resources")41 /​/​Verifying response status code42 .then().statusCode(200);43 /​/​Closing the remote client connection44 driver.quit();45 }46}

Language: Javascript

copy
1/​/​ Mocha and Chai.23/​/​ Assumption: The API endpoints have been documented and access keys provided.45const request = require('request');6const assert = require('chai').assert;7const baseUrl = '<INSERT BASE URL HERE>';89describe('API Security Testing', function() {1011 /​/​ Assumption: The API key is valid and authorized for all the API endpoints.12 const headers = {13 'Authorization': 'Bearer <INSERT API KEY HERE>'14 };1516 it('should return the resource with a valid API token', function(done) {17 const url = baseUrl + '<INSERT ENDPOINT HERE>';18 request.get(url, { headers: headers }, function(error, response, body) {19 assert.equal(response.statusCode, 200);20 assert.isNotNull(body);21 done();22 });23 });2425 it('should return an error with an invalid API token', function(done) {26 const headers = {27 'Authorization': 'Bearer <INSERT INVALID API KEY HERE>'28 };29 const url = baseUrl + '<INSERT ENDPOINT HERE>';30 request.get(url, { headers: headers }, function(error, response, body) {31 assert.equal(response.statusCode, 401);32 done();33 });34 });3536 /​/​ Assumption: The API endpoint has a known vulnerability that should be prevented.37 it('should prevent unauthorized access to vulnerable resource', function(done) {38 const url = baseUrl + '<INSERT VULNERABLE ENDPOINT HERE>';39 request.get(url, { headers: headers }, function(error, response, body) {40 assert.equal(response.statusCode, 403);41 done();42 });43 });4445});4647/​/​ Commented code to connect to remote client with desired capabilities4849/​* const webdriver = require('selenium-webdriver');50const remote = require('selenium-webdriver/​remote');5152const capabilities = {53 browserName: 'chrome',54 version: 'latest',55 platform: 'Windows 10',56 'grid.autoscale': true,57 'grid.maxConcurrentTestSessions': 158};5960const driver = new webdriver.Builder()61 .usingServer('http:/​/​<INSERT REMOTE CLIENT URL HERE>/​wd/​hub')62 .withCapabilities(capabilities)63 .build(); */​

Disclaimer: Following code snippets and related information have been sourced from GitHub and/or generated using AI code generation tools. LambdaTest takes no responsibility in the accuracy of the code and is not liable for any damages.

Accelerate Your Automation Test Cycles With LambdaTest

Leverage LambdaTest’s cloud-based platform to execute your automation tests in parallel and trim down your test execution time significantly. Your first 100 automation testing minutes are on us.

Try LambdaTest

Power Your Software Testing with AI and cloud

Test Intelligently and ship faster. Deliver unparalleled digital experiences for real world enterprises.

Start Free Testing