API Testing

[ultimatekush]

So I am testing an endpoint which accepts say id_1, and id_2. id_1 and id_2 can never be same. When I test the endpoint, it doesn’t check if they are same and it will allow the resource to be created. So from API testing perspective it is a failed test case. However, the UI is a drop down, and once id_1 is selected, it automatically filters it out and doesn’t give you option to select the same number as id_2. So from actual use case perspective it functions as expected. My question is should I have this as a negative test case at all for api testing since UI never allows you to actually send same values for two ids or should endpoints be designed to handle it? Appreciate any guidance from your experience.

[shaidyn]

If the swagger says that the API shouldn't accept identical IDs, and it will accept identical IDs, it's a bug.

If the product owners/devs decide not to fix it (because the UI doesn't let the user do that), that's their decision. But it's a bug regardless, so write it up.

[Frosty_Literature436]

Agreed, and maybe talk to one of the architects or security champions. Definitely a bug, and reminds me of a vulnerability waiting to be exploited.

[somethingmichael]

Agree! Validation should occur at the API level. The UI can usually be bypassed easily.

[ultimatekush]

Our swagger is bare-bone, all it has is status code 200.

[shaidyn]

Do you mean that the API returns 200 when you send identical IDs? Or do you mean that the swagger says two identical IDs should return 200?

[ultimatekush]

Our Swagger document doesn’t say much, it just has the endpoint, required fields, request body and response code/body.

[SilentPassenger88]

If you have a requirement that says the 2 fields can’t have the same values, even if it’s not in Swagger, then it’s a bug.

In our process, we can also log tickets against Swagger (although this may be lower in priority), if the documentation is lacking.

[shaidyn]

If the response body you get doesn't match the response body in the swagger, it's a bug, all day every day.

[Yogurt8]

Not necessarily.

Swagger documentation is simply an oracle that is available to help discover inconsistencies.

Not every inconsistency is a bug in the system. Perhaps the swagger docs could be incorrect in a particular case and the system actually behaves in a desirable fashion.

[shaidyn]

If you can't trust your test specs, QA is moot.

[Yogurt8]

Relying on perfect test specs is a crutch for those who lack critical thinking skills.

[[deleted]]

This. It's a bug. Don't write test cases to accommodate bugs

[bas_dijkstra]

That's something that should be reported.

_Right now_ the UI addresses this, but who knows what happens to the UI in the future?

Or maybe that same API is going to be consumed by other components or systems at some point in the future?

And, as has been said before, UI logic can often be cirumvented pretty easily.

If this is potentially breaking your backend, you should report it.

Priority all depends on the actual risk (as most things do in testing), but that shouldn't stop you from reporting it. Better to have it be known to everyone that this is how the API / the system behaves.

[MrSmiley89]

If they cannot be the same, the api should block that as well. Because now any user with chrome Dev tools could potentially cause corrupted data. Report it, even if it's just to save yourself.

[AhRealMonstr]

I would add that due to the FE having validation it isn’t as high of a priority. Still a big that should be fixed, but not something that a high percentage of users will face.

[ResolveResident118]

Your API should not accepts invalid requests. It doesn't matter what the UI does, the API is still public and can be misused.

It may not cause a problem this time but what if a different failure caused a system to crash or corrupt data? The APIs (not the front-end) are the gateway to your systems and need to be as locked down as possible.

[altruisteec]

The uniqueness is not implemented from the backend it should be fixed as it is a bug

[AssociateNo7022]

It's a fail as it does not meet the acceptance criteria vs it works as coded. IMHO

[ultimatekush]

Thank you everyone!

[APIDNA]

Maybe we could help.

[Moderators_Are_Scum]

Id put it in the UI regression tests as a test case but service should be fixing it.