Reflection based endpoint security test framework
Methods and systems for deploying an enhanced processing system that performs reflection based endpoint security testing are described herein. A computing system may determine, by performing reflection on a web server library, controller types corresponding to an API. For each of the controller types, the computing system may determine method information objects corresponding to the respective controller types. Based on calls to an endpoint method for each of the one or more method information objects, the computing system may determine endpoint failures associated with the API. The endpoint methods may correspond to each of the one or more method information objects. Based on the determined endpoint failures associated with the API, the computing system may adjust one or more endpoints of the API.
1. A system comprising:
at least one processor; and
a memory coupled to the at least one processor,
wherein the at least one processor executes instructions stored in the memory that cause the system to:
determine, by performing reflection on a web server library, one or more controller types corresponding to an application programming interface (API);
determine, for each of the one or more controller types corresponding to the API, one or more method information objects corresponding to the respective controller types;
determine endpoint failures associated with the API based on calls to an endpoint method for each of the one or more method information objects, the endpoint methods corresponding to each of the one or more method information objects, wherein determining the endpoint failures comprises identifying that one or more endpoints of the API failed to distinguish between a valid authentication identifier corresponding to a correct user account and the valid authentication identifier corresponding to an incorrect user account, wherein:
a user of the correct user account should be granted access to the API upon presentation of the valid authentication identifier, and
a user of the incorrect user account should not be granted access to the API upon presentation of the valid authentication identifier; and
adjust the one or more endpoints of the API based on the determined endpoint failures associated with the API, wherein adjusting the one or more endpoints of the API comprises adjusting the one or more endpoints of the API to:
grant access to the user of the correct user account upon presentation of the valid authentication identifier, and
deny access to the user of the incorrect user account upon presentation of the valid authentication identifier.
2. The system of claim 1 , wherein the memory stores additional instructions that, when executed by the at least one processor, cause the system to:
determine, for each of the one or more controller types corresponding to the API, one or more method information objects that are not decorated with a security attribute.
3. The system of claim 2 , wherein determining the endpoint failures associated with the API comprises determining, based at least in part on the one or more method information objects that are not decorated with a security attribute, the endpoint failures associated with the API.
4. The system of claim 1 , wherein determining the one or more method information objects corresponding to the respective controller types comprises:
after determining an entirety of method information objects corresponding to a first controller type, initiating determination of an entirety of method information objects corresponding to a second controller type of the one or more controller types corresponding to the API.
5. The system of claim 1 , wherein determining the endpoint failures associated with the API comprises verifying one or more attributes corresponding to each of one or more responses, and wherein the one or more attributes corresponding to each of the one or more responses comprise one or more of: response codes, response headers, and response cookies.
6. The method of claim 1 , wherein determining the one or more controller types corresponding to the API comprises determining all of the controller types corresponding to the API.
7. The method of claim 1 , wherein adjusting one or more endpoints of the API based on the determined endpoint failures associated with the API comprises adjusting the one or more endpoints of the API to correct for failure of the one or more endpoints to distinguish between an invalid authentication identifier and a valid authentication identifier.
8. The method of claim 1 , wherein adjusting one or more endpoints of the API based on the determined endpoint failures associated with the API comprises adjusting the one or more endpoints of the API to correct for failure of the one or more endpoints to distinguish between an expired authentication identifier and an up to date authentication identifier.
9. The method of claim 1 , wherein adjusting one or more endpoints of the API based on the determined endpoint failures associated with the API comprises adjusting the one or more endpoints of the API to correct for failure of the one or more endpoints to distinguish between requests to access the API that include an authentication identifier and requests to access the API that do not include an authentication identifier.
10. The method of claim 1 , wherein determining the endpoint failures associated with the API comprises identifying that the one or more endpoints of the API granted access to
a user of the incorrect user account API upon presentation of the valid authentication identifier.
11. A method comprising:
determining, by performing reflection on a web server library, one or more controller types corresponding to an application programming interface (API);
determining, for each of the one or more controller types corresponding to the API, one or more method information objects corresponding to the respective controller types;
sending, to an API host platform and for each of the one or more method information objects corresponding to the respective controller types, a request to generate a call to an endpoint method corresponding to each of the respective method information objects;
receiving, from the API host platform, one or more responses corresponding to the respective calls to the endpoint methods;
determining, using the one or more responses corresponding to the respective calls to the endpoint methods, a list of endpoint failures associated with the API, wherein determining the list of endpoint failures comprises identifying that one or more endpoints of the API failed to distinguish between a valid authentication identifier corresponding to a correct user account and the valid authentication identifier corresponding to an incorrect user account, wherein:
a user of the correct user account should be granted access to the API upon presentation of the valid authentication identifier, and
a user of the incorrect user account should not be granted access to the API upon presentation of the valid authentication identifier; and
adjusting the one or more endpoint of the API based on the determined list of endpoint failures associated with the API, wherein adjusting the one or more endpoints of the API comprises adjusting the one or more endpoints of the API to:
grant access to the user of the correct user account upon presentation of the valid authentication identifier, and
deny access to the user of the incorrect user account upon presentation of the valid authentication identifier.
12. The method of claim 11 , further comprising:
determining, for each of the one or more controller types corresponding to the API, one or more method information objects that are not decorated with a security attribute.
13. The method of claim 12 , wherein determining the list of the endpoint failures associated with the API comprises determining, based at least in part on the one or more method information objects that are not decorated with a security attribute, the list of the endpoint failures associated with the API.
14. The method of claim 11 , wherein determining the one or more method information objects corresponding to the respective controller types comprises:
after determining an entirety of method information objects corresponding to a first controller type, initiating determination of an entirety of method information objects corresponding to a second controller type of the one or more controller types corresponding to the API.
15. The method of claim 11 , wherein determining the list of endpoint failures associated with the API comprises verifying one or more attributes corresponding to each of the one or more responses, wherein the one or more attributes corresponding to each of the one or more responses comprise one or more of: response codes, response headers, and response cookies.
16. One or more non-transitory computer-readable media storing instructions that, when executed by a system comprising at least one processor, a communication interface, and memory, cause the system to:
determine, by performing reflection on a web server library, one or more controller types corresponding to an application programming interface (API);
determine, for each of the one or more controller types corresponding to the API, one or more method information objects corresponding to the respective controller types;
determine endpoint failures associated with the API based on calls to endpoint methods for each of the one or more method information objects, wherein the calls to the endpoint methods correspond to each of the one or more method information objects, and wherein determining the endpoint failures comprises identifying that one or more endpoints of the API failed to distinguish between a valid authentication identifier corresponding to a correct user account and the valid authentication identifier corresponding to an incorrect user account, wherein:
a user of the correct user account should be granted access to the API upon presentation of the valid authentication identifier, and
a user of the incorrect user account should not be granted access to the API upon presentation of the valid authentication identifier; and
adjusting the one or more endpoints of the API based on the determined endpoint failures associated with the API, wherein adjusting the one or more endpoints of the API comprises adjusting the one or more endpoints of the API to:
grant access to the user of the correct user account upon presentation of the valid authentication identifier, and
deny access to the user of the incorrect user account upon presentation of the valid authentication identifier.
17. The one or more non-transitory computer-readable media of claim 16 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the system to:
determine, for each of the one or more controller types corresponding to the API, one or more method information objects that are not decorated with a security attribute.
18. The one or more non-transitory computer-readable media of claim 17 , wherein determining the endpoint failures associated with the API comprises determining, based at least in part on the one or more method information objects that are not decorated with a security attribute, the endpoint failures associated with the API.
19. The one or more non-transitory computer-readable media of claim 16 , wherein determining the one or more method information objects corresponding to the respective controller types comprises:
after determining an entirety of method information objects corresponding to a first controller type, initiating determination of an entirety of method information objects corresponding to a second controller type of the one or more controller types corresponding to the API.
20. The one or more non-transitory computer-readable media of claim 19 , wherein determining the endpoint failures associated with the API comprises verifying one or more attributes corresponding to each of one or more responses corresponding to the respective calls to the endpoint methods, wherein the one or more attributes corresponding to each of the one or more responses comprise one or more of: response codes, response headers, and response cookies.