search

gingeleski / cucumber-spring-security-tests

Cucumber/BDD security tests example for Java (Spring Boot API).
9 stars 8 forks source link

Refactor all request-making for tests to Apache HttpComponents #26

Closed gingeleski closed 4 years ago

gingeleski commented 6 years ago

In the Aspect client project on which this is predominantly based, I used the Apache HttpComponents library for request making because of the superior control they allow over minute attributes. I am again finding that it is required.

For example, the RestTemplate forces Content-Type header if it doesn't find one when a request is fired. It guesses, which is great for normal circumstances, not for the security tests. One test case tries to see how the server responds when there is no Content-Type header.

In another example, we're going to have a test case that fires an HTTP/1.0 (as opposed to HTTP/1.1) request at the server, with no Host header. Current request-making methodology can't do the first part and I suspect it'll force the second part just like it does Content-Type.

Hence, for making HTTP requests in the integration test cases, we need Apache HttpComponents and not RestTemplate.

gingeleski commented 6 years ago

Official webpage

Gradle include:

compile group: 'org.apache.httpcomponents', name: 'httpclient', version: '4.5.5'
gingeleski commented 4 years ago

Actually I think this is sufficient for now.

Really the application under test needs to develop further before the more "exotic" test cases can be exercised on it.

At which time, the specifics of leveraging Apache HttpComponents (HttpClient) should probably warrant separate issues.