API Testing : Check CSRF attack handling

Verify that the API correctly handles cross-site request forgery (CS) attacks and returns the correct HTTP status code.

Language: Java

Framework: Rest assured

copy
1/​/​Assuming the API Endpoint URL is https:/​/​example.com/​testAPI23import io.restassured.RestAssured;4import io.restassured.response.Response;5import org.junit.Test;6import static org.junit.Assert.assertEquals;7import static org.junit.Assert.assertTrue;89public class APITest {1011 @Test12 public void testCSRFAttackHandling() {1314 /​/​Assuming CSRF attack payload15 String attackPayload = "csrfPayload";1617 /​/​Setting request headers18 RestAssured.given()19 .header("X-Requested-With", "XMLHttpRequest")20 .header("Content-Type", "application/​json;charset=UTF-8")21 .body(attackPayload)22 .when()23 .post("https:/​/​example.com/​testAPI")24 .then()25 .statusCode(403);2627 /​/​Assuming a valid request payload28 String validPayload = "validPayload";2930 /​/​Setting request headers31 Response response = RestAssured.given()32 .header("X-Requested-With", "XMLHttpRequest")33 .header("Content-Type", "application/​json;charset=UTF-8")34 .body(validPayload)35 .when()36 .post("https:/​/​example.com/​testAPI")37 .then()38 .extract()39 .response();4041 /​/​Assuming CSRF handling is implemented in API42 assertTrue(response.getBody().asString().contains("CSRF detected"));4344 /​/​Assuming that the API returns HTTP status code 200 on successful request45 assertEquals(200, response.getStatusCode());4647 /​/​Assuming the driver is running locally48 /​/​Connecting to remote client with desired capabilities49 /​*50 DesiredCapabilities capabilities = new DesiredCapabilities();51 capabilities.setCapability("browserName", "chrome");52 capabilities.setCapability("version", "91.0");53 capabilities.setCapability("platform", "Windows 10");54 WebDriver driver = new RemoteWebDriver(new URL("http:/​/​localhost:4444/​wd/​hub"), capabilities);55 */​5657 }58}

Language: Javascript

copy
1/​/​ Mocha and Chai.23/​/​Assumptions: 4/​/​1. The API endpoint for the CSRF attack handling is already defined.5/​/​2. Request payload will be provided in the test case.67const chai = require('chai');8const chaiHttp = require('chai-http');910chai.use(chaiHttp);1112describe('API Testing', () => {13 it('should correctly handle CSRF attack and return correct HTTP status code', (done) => {14 chai.request('http:/​/​localhost:3000')15 .post('/​csrf-attack-handler')16 .send({'payload': 'data'})17 .end((err, res) => {18 /​/​tells Mocha that the test is done19 done();20 /​/​assert that there is no error21 chai.expect(err).to.be.null;22 /​/​assert that the status code returned is 20023 chai.expect(res).to.have.status(200);24 });25 });26});2728/​/​Code to use local driver29/​/​Before running, please install Selenium WebDriver and the appropriate browser driver (e.g. chromedriver) for your testing environment30const webdriver = require('selenium-webdriver');31const chrome = require('selenium-webdriver/​chrome');32const firefox = require('selenium-webdriver/​firefox');33const By = webdriver.By;3435const options = new chrome.Options();36/​/​add more options here as needed3738const driver = new webdriver.Builder()39 .forBrowser('chrome')40 .setChromeOptions(options)41 .build();

Disclaimer: Following code snippets and related information have been sourced from GitHub and/or generated using AI code generation tools. LambdaTest takes no responsibility in the accuracy of the code and is not liable for any damages.

Accelerate Your Automation Test Cycles With LambdaTest

Leverage LambdaTest’s cloud-based platform to execute your automation tests in parallel and trim down your test execution time significantly. Your first 100 automation testing minutes are on us.

Try LambdaTest

Power Your Software Testing with AI and cloud

Test Intelligently and ship faster. Deliver unparalleled digital experiences for real world enterprises.

Start Free Testing