Postman & API Testing by Amber Race, Senior SDET at Big Fish Games

1. Postman & API Testing
Amber Race
Senior SDET at Big Fish Games
Up Next

2. EXPLORING YOUR APIS
WITH POSTMAN
Amber Race (@ambertests)
Senior SDET, Big Fish Games

3. Get Yer Samples!
All code shown in this talk is available on my Github!
https://github.com/
ambertests/explore-with-
postman

4. Explorator
y Testing
Testing without a pre-set script
or set of test steps.

5. Amber Race - @ambertests
https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-
all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/
TESTING A PUBLICLY FACING API
THROUGH YOUR UI IS NOT ENOUGH!!!!!

6. Getting the Goods

7. Import From Chrome

8. Import From Swagger

9. Amber Race - @ambertests
Service Test
Strategy
P – Parameters
O – Output
I – Interop
S – Security
E – Error Handling
D – Data

10. Amber Race - @ambertests
PARAMETERS
• The client
is always
wrong
• Boundaries
• Business
rules

12. Amber Race - @ambertests
OUTPUT
• Status
codes
• Headers
• Logging

13. Logging and Status Codes

14. Amber Race - @ambertests
INTEROP
• Clients
• Dependencies

16. Amber Race - @ambertests
SECURITY
• Authentication and
spoofing
• Exposed data
• SQL Injection
• “Hidden” apis

18. Amber Race - @ambertests
EXCEPTIONS
• No
unhandled
exceptions
• Error info,
but not too
much

20. Amber Race - @ambertests
DATA
• Updates and
replication
• Unicode
• Caching

22. Amber Race - @ambertests
More
Resources
■ Restful-Booker: https://restful-
booker.herokuapp.com/
■ Danny Dainton’s Postman Tips:
https://github.com/DannyDainton/All-
Things-Postman
■ Postman Blog: http://
blog.getpostman.com/
■ Big List of Naughty Strings: https://
github.com/minimaxir/big-list-of-naughty-
strings
■ Workshop Materials: https://
github.com/ambertests/explore-with-
postman

23. Amber Race - @ambertests
Thank you for
attending!
■ Email:
amber.race
@outlook.co
m
■ LinkedIn:
https://
www.linkedin.c
om/in/amber-
race-tests
■ Twitter:
@ambertest
s