Exercises
4.1🔒BeginnerExercise 16: Write tests for a login endpoint: valid credentials return 200 with a token, invalid password returns 401, missing email…
4.2🔒IntermediateExercise 18: Write a complete JWT lifecycle test: obtain a token, use it to access a protected resource, let it expire (or use a…
4.3🔒AdvancedExercise 20: Write an IDOR test suite: create two users with different tokens, verify that User A cannot read, update, or delete User B's…
4.4🔒Q&AResume phrasing- Designed and executed authentication test suites covering JWT lifecycle, OAuth 2.0 flows, and session cookie security attributes…
4.5🔒Q&ACover letter framingAuthentication and authorization testing is where QA directly protects the business. I test the complete auth lifecycle -- from token…
4.6🔒Q&AInterview framing"I approach auth testing in three layers. First, the authentication layer: valid credentials succeed, invalid credentials fail with generic…
4.7🔒Q&AWhat not to say- "I just test that login works with the right password." -- Misses the entire negative testing surface: expired tokens, tampered JWTs…
4.8🔒Q&AQuestion 1Prompt: Your API returns "Invalid password" for wrong passwords but "User not found" for non-existent emails. The security team flags this…
4.9🔒Q&AQuestion 2Prompt: You discover that your API accepts a JWT signed with the none algorithm -- meaning anyone can forge a valid-looking token without…
4.10🔒Q&AQuestion 3Prompt: Your RBAC test matrix has 5 roles and 30 endpoints with 4 HTTP methods each. That is 600 test cases. The test suite takes too long…
4.11🔒Q&AQuestion 4Prompt: A developer implements token refresh but does not invalidate the old refresh token after use. Walk through the security…
4.12🔒Rate Limit HeadersWell-designed APIs include rate limit information in response headers:
4.13🔒Best Practices for Environment Management
4.14🔒Marking Tests for Environment SafetyCOMMON MISTAKE: Running the full test suite (including write/delete tests) against the production environment. Always tag destructive tests…