DEV Community

45 ways to break an API server (negative tests with examples)

zvone187 on April 19, 2023

As developers, we strive to write error-free code, but no one actually does so because...well, bugs. In order to catch those pesky bugs before they...
Collapse
 
michaeltharrington profile image
Michael Tharrington

Wow! This is super cool. Appreciate ya sharing all this research. Pythagora sounds like a really cool tool!

Collapse
 
zvone187 profile image
zvone187

Thank you so much Michael! Did you maybe try Pythagora? I'd love to hear your feedback.

Collapse
 
michaeltharrington profile image
Michael Tharrington

To be honest, I haven't.

I'm a Community Manager here with admittedly very limited technical abilities. 😅 That said, I do feel like I have a decent understanding of what's going on here — you've created Pythagora to automatically generates negative tests to make sure that whatever is being built can handle unexpected inputs and edge cases. And in the process of doing that ya researched a bunch of ways one can break an API server, which is what ya have shared here.

So yeah, no use from me here (yet! ... hey, there's always a chance I get more techie in the future), but I do really think this is a great idea!

Thread Thread
 
zvone187 profile image
zvone187

Ah, got it. Btw, it's great that you understood what's happening here without being a QA or a dev. I'd say this is advanced for a non-tech person. Btw, do you have any devs around you who can try out Pythagora? As you can imagine, we're super early so any support/feedback would mean the world to me.

Thread Thread
 
michaeltharrington profile image
Michael Tharrington

Thanks a bunch, ya explained it well which helps!

I feel you on the struggle of starting small and trying to reach folks. So, while I can't commit on behalf of others, I will definitely throw the suggestion out there to our devs on the team via Slack and see if anybody is interested. 🙂

And now I'm gonna put my DEV Community Manager hat on for a sec... One thing you might consider with Pythagora is setting up a free organization on DEV for it. You can check out our organization info page to learn about some of the perks of using an org and if you wanna get a sense of what it's like, you can see the DEV Team org page here — just click through some of our posts and you'll see how our org branding appears around them. Using orgs helps with general brand recognition because as folks are reading your posts and learning about Pythagora, they'll also see your logo in places and you have the option to point them to your website/repo/etc. I'll not blab about orgs for too much longer, haha, you can check out the info page and feel free to hit me up if you have any questions!

I really wish you and the rest of the Pythagora team the best! It really does sound like y'all are building something cool.

Thread Thread
 
zvone187 profile image
zvone187

Oh nice, did it! Thanks for this, I didn't know dev.to has orgs.

Re sharing Pythagora, thank you so much!!! This really means a lot. Wherever you can share it, I'd be more than thankful.

Collapse
 
artdevgame profile image
Mike Holloway

Cool article, simple & clear.

@zvone187 Reading the comments it looks like you're keen for feedback & even though I haven't tried it yet (I will at some point), my first thoughts are that the name Pythagora is an interesting choice given that the tool generates tests "for your Node.js app"

If I didn't have the context that this article provides, I might have overlooked the repo if I had discovered it another way because I thought it was a tool for a Python codebase.

Collapse
 
zvone187 profile image
zvone187

Hi Mike,

Thanks! I'm glad you like it.

Re name, yes, you're completely right. I didn't think too long when I was choosing the name - I just took what had a domain available. It will come to it's place when we support Python.

Btw, yes, I'm definitely eager to hear feedback so I'd appreciate so much to hear yours as well. Also, if you get stuck anywhere, let me know, I'd be happy to help.

Collapse
 
starboysharma profile image
Pankaj Sharma

I think most of this type of problem can be easily managed by joi package.

Collapse
 
zvone187 profile image
zvone187

Oh nice, good one. Never used it but it seems like it should handle many of these. Btw, were you able to see Pythagora (github.com/Pythagora-io/pythagora)? Since you're familiar with automated testing, I'm curious to hear your opinion on it. Would you use generated tests for your projects?

Collapse
 
starboysharma profile image
Pankaj Sharma • Edited

Pythagora sounds interesting will going to take a look soon.

Thanks for sharing 🙂

Thread Thread
 
zvone187 profile image
zvone187

Oh awesome, I'm looking forward to hearing what you think.

Collapse
 
rmaurodev profile image
Ricardo

Excellent !

Collapse
 
zvone187 profile image
zvone187

Thanks Ricardo! Are you used to building negative tests in your team?

Collapse
 
manuelbrs profile image
Juan Manuel Bello

Great Articule,

thanks for sharing, good cases to keep in mind.

Collapse
 
zvone187 profile image
zvone187

Thank you so much Juan!