Application programming interface security validation for system integration testing
Techniques are provided to implement application programming interface (API) security validation testing for system integration testing (SIT) in a continuous integration environment. For example, a SIT tool detects a change in master code associated with an application comprising a plurality of microservices and an API gateway to route client API requests to the microservices of the application. The SIT tool obtains a listing of API endpoints exposed by the microservices of the application. The SIT tool performs an automated API security test validation process to determine whether an API security test file has been created for each API endpoint in the listing of API endpoints. The SIT tool fails the API security test validation process in response to determining that an API security test file has not be created for one or more API endpoints in the listing of API endpoints.
1. A method, comprising:
detecting, by a system integration testing (SIT) tool, a change in master code associated with an application comprising a plurality of microservices and an application programming interface (API) gateway to route client API requests to the microservices of the application;
obtaining, by the SIT tool, a listing of API endpoints exposed by the microservices of the application; and
performing, by the SIT tool, an automated API security test validation process which comprises:
determining whether each API endpoint in the listing of API endpoints has an associated API security test file which has been created to test a security of the API endpoint;
generating a test failure indication in response to determining that an associated API security test file has not been created for one or more API endpoints in the listing of API endpoints;
in response to determining that each API endpoint in the listing of API endpoints has an associated API security test file, determining whether the associated API security test file of a given API endpoint in the listing of API endpoints comprises a test for validating at least one element of the given API endpoint; and
generating a test failure indication in response to determining that the associated API security test file of the given API endpoint does not comprise a test for validating at least one element of the given API endpoint.
2. The method of claim 1 , wherein obtaining the listing of API endpoints comprises the SIT tool issuing an API request to the API gateway to obtain the listing of API endpoints.
3. The method of claim 2 , wherein the listing of API endpoints comprises a whitelist of permitted API endpoints of registered microservices of the application, which is generated by the API gateway.
4. The method of claim 1 , wherein:
determining whether the associated API security test file of the given API endpoint in the listing of API endpoints comprises a test for validating at least one element of the given API endpoint comprises determining whether the associated API security test file for the given API endpoint specifies a validation test for each parameter of the given API endpoint; and
generating a test failure indication in response to determining that the associated API security test file of the given API endpoint does not comprise a test for validating at least one element of the given API endpoint comprises generating a test failure indication in response to determining that the associated API security test file for the given API endpoint does not specify a validation test for at least one parameter of the given API endpoint.
5. The method of claim 1 , wherein:
determining whether the associated API security test file of the given API endpoint in the listing of API endpoints comprises a test for validating at least one element of the given API endpoint comprises determining whether the associated API security test file for the given API endpoint specifies a validation test for each method of the given API endpoint; and
generating a test failure indication in response to determining that the associated API security test file of the given API endpoint does not comprise a test for validating at least one element of the given API endpoint comprises generating a test failure indication in response to determining that the associated API security test file for the given API endpoint does not specify a validation test for at least one method of the given API endpoint.
6. The method of claim 1 , comprising:
in response to determining that each API endpoint in the listing of API endpoints has an associated API security test file, the SIT tool continuing the automated API security test validation process by:
performing a test procedure on the given API endpoint to determine whether the given API is behaving properly, wherein the test procedure comprises (i) generating an invalid API request for the given API endpoint, and (ii) passing the invalid API request to the given API endpoint to determine whether the given API endpoint accepts or rejects the invalid API request; and
generating a test failure indication in response to determining that the given API endpoint accepts the invalid API request.
7. The method of claim 6 , wherein generating the invalid API request for the given API endpoint comprises generating an API request with at least one of an invalid parameter and an invalid parameter value.
8. The method of claim 6 , wherein generating the invalid API request for the given API endpoint comprises generating an API request with an invalid method that is not supported by the given API endpoint.
9. The method of claim 6 , wherein generating the invalid API request for the given API endpoint comprises generating an API request with a size that exceeds a predefined threshold.
10. An article of manufacture comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code is executable by one or more processors to implement a method comprising:
detecting, by a system integration testing (SIT) tool, a change in master code associated with an application comprising a plurality of microservices and an application programming interface (API) gateway to route client API requests to the microservices of the application;
obtaining, by the SIT tool, a listing of API endpoints exposed by the microservices of the application; and
performing, by the SIT tool, an automated API security test validation process which comprises:
determining whether each API endpoint in the listing of API endpoints has an associated API security test file which has been created to test a security of the API endpoint;
generating a test failure indication in response to determining that an associated API security test file has not been created for one or more API endpoints in the listing of API endpoints;
in response to determining that each API endpoint in the listing of API endpoints has an associated API security test file, determining whether the associated API security test file of a given API endpoint in the listing of API endpoints comprises a test for validating at least one element of the given API endpoint; and
generating a test failure indication in response to determining that the associated API security test file of the given API endpoint does not comprise a test for validating at least one element of the given API endpoint.
11. The article of manufacture of claim 10 , wherein obtaining the listing of API endpoints comprises the SIT tool issuing an API request to the API gateway to obtain the listing of API endpoints.
12. The article of manufacture of claim 11 , wherein the listing of API endpoints comprises a whitelist of permitted API endpoints of registered microservices of the application, which is generated by the API gateway.
13. The article of manufacture of claim 10 , wherein:
the program code for determining whether the associated API security test file of the given API endpoint in the listing of API endpoints comprises a test for validating at least one element of the given API endpoint comprises program code for determining whether the associated API security test file for the given API endpoint specifies a validation test for each parameter of the given API endpoint; and
the program code for generating a test failure indication in response to determining that the associated API security test file of the given API endpoint does not comprise a test for validating at least one element of the given API endpoint comprises program code for generating a test failure indication in response to determining that the associated API security test file for the given API endpoint does not specify a validation test for at least one parameter of the given API endpoint.
14. The article of manufacture of claim 10 , wherein:
the program code for determining whether the associated API security test file of the given API endpoint in the listing of API endpoints comprises a test for validating at least one element of the given API endpoint comprises program code for determining whether the associated API security test file for the given API endpoint specifies a validation test for each method of the given API endpoint; and
the program code for generating a test failure indication in response to determining that the associated API security test file of the given API endpoint does not comprise a test for validating at least one element of the given API endpoint comprises program code for generating a test failure indication in response to determining that the associated API security test file for the given API endpoint does not specify a validation test for at least one method of the given API endpoint.
15. The article of manufacture of claim 10 , wherein the program code is executable by the one or more processors to implement a method comprising:
in response to determining that each API endpoint in the listing of API endpoints has an associated API security test file, the SIT tool continuing the automated API security test validation process by:
performing a test procedure on the given API endpoint to determine whether the given API is behaving properly, wherein the test procedure comprises (i) generating an invalid API request for the given API endpoint, and (ii) passing the invalid API request to the given API endpoint to determine whether the given API endpoint accepts or rejects the invalid API request; and
generating a test failure indication in response to determining that the given API endpoint accepts the invalid API request.
16. The article of manufacture of claim 15 , wherein generating the invalid API request for the given API endpoint comprises generating an API request with at least one of an invalid parameter and an invalid parameter value.
17. The article of manufacture of claim 15 , wherein generating the invalid API request for the given API endpoint comprises generating an API request with an invalid method that is not supported by the given API endpoint.
18. The article of manufacture of claim 15 , wherein generating the invalid API request for the given API endpoint comprises generating an API request with a size that exceeds a predefined threshold.
19. A server node, comprising:
at least one processor; and
system memory configured to store program code, wherein the program code is executable by the at least one processor to instantiate systems integration testing (SIT) tool, wherein the SIT tool is configured to:
detect a change in master code associated with an application comprising a plurality of microservices and an application programming interface (API) gateway to route client API requests to the microservices of the application;
obtain a listing of API endpoints exposed by the microservices of the application; and
perform an automated API security test validation process, wherein in performing the automated API security test validation process, the SIT is configured to:
determine whether each API endpoint in the listing of API endpoints has an associated API security test file which has been created to test a security of the API endpoint;
generate a test failure indication response to determining that an associated API security test file has not been created for one or more API endpoints in the listing of API endpoints;
in response to determining that each API endpoint in the listing of API endpoints has an associated API security test file, determine whether the associated API security test file of a given API endpoint in the listing of API endpoints comprises a test for validating at least one element of the given API endpoint; and
generate a test failure indication in response to determining that the associated API security test file of the given API endpoint does not comprise a test for validating at least one element of the given API endpoint.
20. The server node of claim 19 , wherein:
in determining whether the associated API security test file of a given API endpoint in the listing of API endpoints comprises a test for validating at least one element of the given API endpoint the SIT tool is configured to:
determine whether the associated API security test file for the given API endpoint specifies a validation test for each parameter of the given API endpoint, and generate a test failure indication in response to determining that the associated API security test file for the given API endpoint does not specify a validation test for at least one parameter of the given API endpoint; and
determine whether the associated API security test file for the given API endpoint specifies a validation test for each method of the given API endpoint, and generate a test failure indication in response to determining that the associated API security test file for the given API endpoint does not specify a validation test for at least one method of the given API endpoint; and
the SIT tool is further configured to perform a test procedure on the given API endpoint to determine whether the given API is behaving properly, wherein the test procedure comprises (i) generating an invalid API request for the given API endpoint, and (ii) passing the invalid API request to the given API endpoint to determine whether the given API endpoint accepts or rejects the invalid API request; and
generate a test failure indication in response to determining that the given API endpoint accepts the invalid API request.