API Security Assurance via E2E Testing
summary
Argues that API security becomes continuous by baking concrete checks into E2E suites, demonstrates a toy app called insecure Cuts, shows failing then fixed tests for weak passwords using NestJS and SuperTest, adds security headers via helmet, and uses Bard to auto-generate authorization and abuse-case specs. Presents reusable test templates, immediate CI feedback when auth or input validation regresses, and live demos where a failing test turns green after a small code change.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 4:30Alex Mor Introduction
- 6:37Agenda
- 7:51Motivation
- 10:07Challenge
- 11:48Software Testing
- 16:56Why do we do testing
- 21:27Secure Cuts
- 25:37Spec Style
- 29:02Data Transfer Object
- 32:27Lockout Scripts
- 33:22Test Frameworks
- 43:17AI Security Testing
- 48:27Security Headers
- 51:57Next Steps
related talks
08mAutomated Security Testing for JS Apps
17mAn API Security Testing Blueprint: Because Unit Tests Just Aren't Enough.
52mAPI Security Testing
33mWhy Developers Struggle with API Security
44mShift-Left-Security with the Security Test Pyramid
08mAPI Security Risks
46mAPI Security – Divide & Conquer
17mAPI Security Simplified: Practical Tips & Tools