Running system tests with active authn/z
summary
Shows a concrete pipeline: spin up the app and APIs in Docker compose, point them at a separate Office 365 developer tenant, switch login to resource owner password credentials for test users without MFA, drive real browser flows with Cypress in Docker compose, and verify tokens at each API. Test-support code is tiny (about 15 lines), tests run headless in CI and return proper exit codes. Trade-offs include leaked access tokens in logs and maintenance of the test tenant so threat modeling is required.
AI-written summary · about
chapters (17)
- 0:00System testing with active auth
- 5:20Current testing practices
- 7:26System architecture overview
- 11:04Testing with active auth challenges
- 12:31Security testing principles
- 17:48Testing trade-offs
- 20:35Test environment with Docker
- 26:30Cypress tests in test mode
- 31:03Automating tests in CI/CD
- 34:15Solution summary and next steps
- 35:18Q&A Azure AD and MFA
- 37:24Q&A distributed system testing
- 39:15Q&A 2FA alternatives
- 40:41Q&A mock users and app regs
- 43:51Q&A token verification in APIs
- 45:22Q&A Blazor WASM unit testing
- 48:12Closing remarks
related talks
10mStrategies for testing Authentication and Authorization Flows
55mPlants vs thieves: Automated Tests in the World of Web Security
48mNavigating the depths of API security testing
26mTales from the QA crypt
27mI see your point, but… (Part 1)
22msecure.AllTheThings() - Make Security Accessible to Everyone!
30mUsing Docker & Compose to Simplify Integration Testing
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way