In most definitions of negative testing, the idea is that we test outside what is specified/expected and it is highly related to robustness.
So basically, if the behavior for such conditions is defined, I would be positive testing as we verify behavior that is specified, isnt that so?
An example requirement:
REQ1: Name is a text field with maximal length of 32 chars.
In this case, I could try neative test cases with numbers, special characters etc.
However, what about this:
REQ1: Name is a text field with maximal length of 32 chars. If a non-alphabetical character is entered, except for a space, a message "Incorrect character entered" is shown.
In this case, I would say that now those tests are positive as I verify the spec.
I ask because I have read the following, in a book Fuzzing for Software security testing:
in a login feature..a positive tests would consist of trying a valid user name and a valid password. Everything else is negative testing.
That does not seem to be right to me. Usually the behavior for wrong login is pretty well defined and specified so strictly speaking, again I verify described behavior.
Is my understanding correct?
To support the definition I mean, I quote a few books below:
Positive testing is done to verify known test conditions and negative testing is done to break the product with unknowns.
Most systems are designed with explicit and implicit restrictions and constraints. Negative test cases can be derived to test conditions outside of those restrictions and constraints.