2

QA here. Relatively new to API testing (manual). Thought I'd turn to the experts to try and figure out if my expectations around how much functionality should sit in the API are more or less valid. More specifically, I'm testing dependencies ie.

if input_field_1 = No then input field 2 should be read-only

if input_field_1 = Yes then input field 2 should be enabled

I'd expect that if I didn't change the value from No to Yes in the API for input_field_1, then trying to manipulate the value of input_field_2 would have no effect and should not be updated when the call is executed. This is not the case.

My devs say that this logic is not necessary in the API because it is handled by the frontend and if an input field is read-only (dependent on another field), it would essentially never pass through a value in the first place. They also say that the API is basically impenetrable and no one would ever be carrying out this sort of manipulation (but I am). I understand the first half of this sentiment, but I'm still reluctant to omit these edge cases in the API. Essentially, I am able to update fields that should be read-only in the API and those changes are pulling through to the frontend. This doesn't seem technically sound or correct to me.

Improve this question
2
  • What kind of API is it (web api?) and how exposed is it ? Can anyone build an URL (for exemple) passing input1 and inpuit2 as parameters and manipulate 2 with 1 set to no like you did ?
    – JayZ
    Jan 6, 2021 at 15:22
  • Yes JayZ, it is a WebAPI. It will only be accessible in an internal work group network using AD. Yes to the 2nd question as well - anyone is capable of manipulating the params..
    – Jasmine
    Jan 6, 2021 at 16:25

1 Answer 1

Reset to default
11

Data must always be validated again in the backend, even if it is already validated in the frontend.

The fundamental principle at work here is this: you cannot trust the frontend. It could contain a bug or virus. It might not be your frontend at all; it might be some other program written by a bad actor to gain access to your systems.

So why validate in the frontend? For convenience. Front-end programs are meant to promote better user interaction; this includes avoiding a round trip to the server to validate data.

The API is not impenetrable just because your developers say it is. It is reasonably secure because your tests say it is.

Improve this answer
9
  • 2
    That being said, you're technically not mirroring your test between backend and frontend. The backend and frontend test their own validation. If one of them doesn't have a validation (and you have a valid point that they usually should, or at least definitely the backend and maybe the frontend too), then you don't write a test for that validation there.
    – Flater
    Jan 6, 2021 at 15:29
  • Data must always be validated again in the backend, even if it is already validated in the frontend. <-- I've been trying to stress this to the devs, but they say that it is enough for it to be handled by the frontend exclusively.
    – Jasmine
    Jan 6, 2021 at 16:30
  • There is less peril if the API is internal, but it still does not constitute a secure system. The API should be self-contained; it should not depend on anything else for its proper functioning, including validation from a frontend system.
    – Robert Harvey
    Jan 6, 2021 at 16:31
  • 1
    if an input field is read-only there, shouldn't it effectively be the same in the WebAPI? -- Well, why is it read-only in the frontend? Are there compelling reasons for that field to be read-only? If those reasons also apply to the API itself (and not just to this particular frontend program), then the API still needs its own validation.
    – Robert Harvey
    Jan 6, 2021 at 16:38
  • 3
    In this particular scenario, very compelling reasons. Read-only on the frontend to prohibit a workflow from moving forward. The devs have also told me that a good WebAPI should be able to function on it's own if the frontend framework is removed for whatever reason and replaced. That has really stuck with me, but when I challenge them and use their own words as motivation, they pick and choose which scenarios it's applicable to. You've been a great help Mr. Harvey. Thank you so much!
    – Jasmine
    Jan 6, 2021 at 16:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.