SlideShare a Scribd company logo
Testing REST
Web Services
SOA Symposium Berlin 2010
Jan Algermissen, algermissen@acm.org
Jan Algermissen
@algermissen
http://www.nordsc.com/
“Applying the Web to Enterprise IT”
MORE TO TEST THAN
YOU THINK!
Client Server
Communication requires
shared knowledge.
Client Server
Shared Knowledge
Allows Expectations
Client Server
Expectation Levels
Expectation Levels
Message
Expectation Levels
Resource
Message
Expectation Levels
Application
Resource
Message
Expectation Levels
MESSAGE LEVEL
FAULTS
GET /index.html HTTP/1.0
?
GET /index.html HTTP/1.0
HTTP/1.0 204 No Content
/* Hello there */
DELETE /index.html HTTP/1.0
DELETE /index.html HTTP/1.0
HTTP/1.0 404.6 Verb denied
Content-Type: text/plain
Sorry, you cannot delete this resource.
?
GET /index.html HTTP/1.0
GET /index.html HTTP/1.0
HTTP/1.0 305 Use Proxy
?
HTTP 1.1
(RFC 2616)
GET /news HTTP/1.0
GET /news HTTP/1.0
HTTP/1.0 200 Ok
Content-Type: application/atom+xml
<feed>
<entry>
</fee>
?
GET /news HTTP/1.0
GET /news HTTP/1.0
HTTP/1.0 200 Ok
Content-Type: application/atom+xml
<feed>
<link href=”/de/news”
rel=”alternate” hreflang=”de”/>
<link href=”/de/news2”
rel=”alternate” hreflang=”de”/>
</feed>
?
MEDIA TYPE
TESTS
Message
Level
•Correct HTTP syntax?
•Correct HTTP semantics?
•Correct payload syntax?
•Correct payload semantics?
Message level
tests passed!
Are we done testing?
“The notion that REST-based user
agents can't have expectations of a
resource is clearly false.”
-- Roy Fielding
GREAT!
MORE TO TEST
RESOURCE LEVEL
FAULTS
GET /page.html HTTP/1.0
GET /page.html HTTP/1.0
200 Ok
Content-Type: text/html
<html>
<body><p>My dog:
<img src=”/img/dog.jpg”/>
</p></body>
</html>
GET /img/dog.jpg HTTP/1.0
Accept: image/*
GET /img/dog.jpg HTTP/1.0
Accept: image/*
HTTP/1.0 406 Not Acceptable
Content-Length: 0
Link semantics create
expectations.
<html><head>
<link rel=”stylesheet” type=”text/css”
href=”/css/default.css”/>
</head>
....
</html>
“A stylesheet”
<app:collection href=”/blog/entries”>
<app:accept>text/plain</app:accept>
</app:collection>
“A collection”
<OpenSearchDescription>
<Url type=”application/rss+xml”
template=”/search?q={searchTerms}”/>
</OpenSearchDescription>
“A search result”
Link semantics create
expectations.
These expectations can
be tested.
BUT HOW?
Specifications (loosely)
associate link semantics
with media types.
curl -I http://foo.org/img/dog.jpg -HAccept:image/*
HTTP/1.1 406 Not Acceptable
Content-Length: 0
Verify that it is an image
406 —› Test failed
curl -I http://foo.org/blog/entries 
-HAccept:application/atom+xml
HTTP/1.1 200 Ok
Content-Type: application/atom+xml
Verify that it is a collection
200 —› Test passed
Use media types
to test resource
semantics
GET /articles/1002110.html HTTP/1.0
GET /articles/1002110.html HTTP/1.0
HTTP/1.0 200 Ok
Date: Tue, 2 Jun 2010 11:00:00 GMT
Content-Type: text/html
<html>...</html>
GET /articles/1002110.html HTTP/1.0
GET /articles/1002110.html HTTP/1.0
HTTP/1.0 404 Not Found
Date: Wed, 3 Jun 2010 11:00:00 GMT
Content-Type: text/plain
Nothing found that matches the request URI.
?
GET /stock-quote/COKE HTTP/1.0
GET /stock-quote/COKE HTTP/1.0
HTTP/1.0 200 Ok
Date: Tue, 2 Jun 2010 11:00:00 GMT
Content-Type: text/plain
49.5
GET /stock-quote/COKE HTTP/1.0
GET /stock-quote/COKE HTTP/1.0
HTTP/1.0 200 Ok
Date: Wed, 3 Jun 2010 11:00:00 GMT
Content-Type: text/plain
Current weather in Berlin: 25 degrees
Celsius, sunny.
?
Cool URIs don’t change!
GET /orders/42 HTTP/1.0
Accept: application/order
GET /orders/42 HTTP/1.0
Accept: application/order
HTTP/1.0 200 Ok
Date: Tue, 2 Jun 2010 11:00:00 GMT
Content-Type: application/order
<order> ... </order>
GET /orders/42 HTTP/1.0
Accept: application/order
GET /orders/42 HTTP/1.0
Accept: application/order
HTTP/1.0 406 Not Acceptable
Date: Wed, 3 Jun 2010 11:00:00 GMT
Content-Type: text/plain
Media type application/order no longer
available. Try application/order.v2
?
BE NICE!
Keep variants around.
TESTS
Resource
Level
•Does resource match link semantics?
•Is resource available over time?
•Are resource semantics stable over time?
•Are variants available over time?
APPLICATION LEVEL
FAULTS
What’s an application anyway?
•Buying a book in an online store
•Looking up a word in an online dictionary
•Taking an online exam
•Indexing a set of Web sites
•Checking for updates in monitored feeds
•Monitoring programming language
adoption using stackoverflow.com
GET /shop-home.html HTTP/1.0
Host: www.bestbookshop.com
GET /shop-home.html HTTP/1.0
Host: www.bestbookshop.com
HTTP/1.0 200 Ok
Content-Type: text/html
<html><body><p>
Sorry, buying is not possible here anymore.
Check out the store catalog at <a href=”/
catalog.html”/> and walk to one of our
stores. </p></body></html>
?
Application Level Tests
Does the service work
as expected by the application?
Application Level Tests
Does the service work
as expected by the application?
Testable only in context of the application. The server
cannot know how it is being re-used!
TESTS
Application
Level
•Does service offer expected capability?
•Is the user goal reachable?
Testing REST Web Services
Testing REST Web Services
Message
Level
•Correct HTTP syntax?
•Correct HTTP semantics?
•Correct payload syntax?
•Correct payload semantics?
Resource
Level
•Does resource match link semantics?
•Is resource available over time?
•Are resource semantics stable over time?
•Are variants available over time?
Testing REST Web Services
Message
Level
•Correct HTTP syntax?
•Correct HTTP semantics?
•Correct payload syntax?
•Correct payload semantics?
Resource
Level
•Does resource match link semantics?
•Is resource available over time?
•Are resource semantics stable over time?
•Are variants available over time?
Testing REST Web Services
Application
Level
•Does service offer expected capability?
•Is the user goal reachable?
Message
Level
•Correct HTTP syntax?
•Correct HTTP semantics?
•Correct payload syntax?
•Correct payload semantics?
EXPLORE THE
CONTRACT
SERVER MUST PASS TESTS
SERVER MUST PASS TESTS
NO CLIENT ASSUMPTIONS BEYOND TESTS
USE
TESTS AS
GUIDE
Server Developer Client Developer
Server Developer
Guidance
Server must...
•Conform to HTTP
•Conform to the media types used
•Resources must match link semantics
•Keep URIs around
•Keep resource semantics stable
•Maintain variants over time
•Maintain capabilities
Anything else is not
constrained and will
not break clients!
Server may....
•Change representations
•Add resources
•Add variants
•Make full use of HTTP
•Make full use of media types
Client Developer
Guidance
Client may rely on...
•Message level correctness
•Resources matching link semantics
•Bookmarkable URIs
•Stable resource semantics
•Variant availability over time
•Stable service nature
Anything else the
server is absolutely
free to change at any
time.
The client must...
•Implement all of HTTP
•Deal with supported media types
completely
•Prepare for unexpected but valid
responses
Take Aways
•Quite some things to test
•Tests reveal and illustrate contract
•REST constrains over time
•Servers are, in fact, rather constrained
REST achieves
evolvability by
rigorous constraints on
server change!
HAPPY TESTING!
Testing REST Web Services

More Related Content

What's hot (20)

PPTX
Best Practices in Building an API Security Ecosystem
Prabath Siriwardena
 
PDF
In graph we trust: Microservices, GraphQL and security challenges
Mohammed A. Imran
 
KEY
Rest and the hypermedia constraint
Inviqa
 
PDF
REST API and CRUD
Prem Sanil
 
PDF
Restful api design
Mizan Riqzia
 
PPT
Introduction To REST
Bhavya Siddappa
 
PPTX
Getting Started with API Security Testing
SmartBear
 
PPSX
Rest api standards and best practices
Ankita Mahajan
 
PPTX
RESTful modules in zf2
Corley S.r.l.
 
PPT
Application Security
nirola
 
PPTX
Introduction to shodan
n|u - The Open Security Community
 
PPTX
API Security & Federation Patterns - Francois Lascelles, Chief Architect, Lay...
CA API Management
 
PDF
The Ultimate Guide to Mobile API Security
Stormpath
 
PPTX
REST & RESTful Web Services
Halil Burak Cetinkaya
 
PDF
Guide on scaling web app
Ashok Pundit
 
PPTX
Understanding REST APIs in 5 Simple Steps
Tessa Mero
 
PDF
Pentesting Rest API's by :- Gaurang Bhatnagar
OWASP Delhi
 
PPTX
Securing RESTful APIs using OAuth 2 and OpenID Connect
Jonathan LeBlanc
 
ODP
The Internet as Web Services: introduction to ReST
Bruno Kessler Foundation
 
ODP
Creating Web Services with Zend Framework - Matthew Turland
Matthew Turland
 
Best Practices in Building an API Security Ecosystem
Prabath Siriwardena
 
In graph we trust: Microservices, GraphQL and security challenges
Mohammed A. Imran
 
Rest and the hypermedia constraint
Inviqa
 
REST API and CRUD
Prem Sanil
 
Restful api design
Mizan Riqzia
 
Introduction To REST
Bhavya Siddappa
 
Getting Started with API Security Testing
SmartBear
 
Rest api standards and best practices
Ankita Mahajan
 
RESTful modules in zf2
Corley S.r.l.
 
Application Security
nirola
 
Introduction to shodan
n|u - The Open Security Community
 
API Security & Federation Patterns - Francois Lascelles, Chief Architect, Lay...
CA API Management
 
The Ultimate Guide to Mobile API Security
Stormpath
 
REST & RESTful Web Services
Halil Burak Cetinkaya
 
Guide on scaling web app
Ashok Pundit
 
Understanding REST APIs in 5 Simple Steps
Tessa Mero
 
Pentesting Rest API's by :- Gaurang Bhatnagar
OWASP Delhi
 
Securing RESTful APIs using OAuth 2 and OpenID Connect
Jonathan LeBlanc
 
The Internet as Web Services: introduction to ReST
Bruno Kessler Foundation
 
Creating Web Services with Zend Framework - Matthew Turland
Matthew Turland
 

Similar to Testing REST Web Services (20)

ODP
Starting With Php
Harit Kothari
 
PDF
REST in ( a mobile ) peace @ WHYMCA 05-21-2011
Alessandro Nadalin
 
ODP
PHP Training: Module 1
hussulinux
 
PPTX
RESTful APIs
Adi Challa
 
PDF
Restful web-services
rporwal
 
PDF
Concepts for Operating a Web Site
Can Burak Çilingir
 
PDF
Simplify QA Automation: Master API Testing with HTTPClient in C#
digitaljignect
 
PDF
WebApp #3 : API
Jean Michel
 
PDF
HTTP by Hand: Exploring HTTP/1.0, 1.1 and 2.0
Cory Forsyth
 
PPTX
An Introduction To REST API
Aniruddh Bhilvare
 
PPT
The Evolving Security Environment For Web Services
Qanita Ahmad
 
PPT
KMUTNB - Internet Programming 2/7
phuphax
 
PDF
HTTP Basics Demo
InMobi Technology
 
PDF
Resource-Oriented Web Services
Bradley Holt
 
PPTX
The Top Tips You need to Learn about Data in your Mobile App
Woodruff Solutions LLC
 
PDF
zendframework2 restful
tom_li
 
PPTX
Messaging for Real-time WebApps
Tiju John
 
PPTX
Rest WebAPI with OData
Mahek Merchant
 
PPTX
Module 5.pptx HTTP protocol on optical and wireless communication
chandushivamurthy4
 
PPTX
Http_Protocol.pptx
Abshar Fatima
 
Starting With Php
Harit Kothari
 
REST in ( a mobile ) peace @ WHYMCA 05-21-2011
Alessandro Nadalin
 
PHP Training: Module 1
hussulinux
 
RESTful APIs
Adi Challa
 
Restful web-services
rporwal
 
Concepts for Operating a Web Site
Can Burak Çilingir
 
Simplify QA Automation: Master API Testing with HTTPClient in C#
digitaljignect
 
WebApp #3 : API
Jean Michel
 
HTTP by Hand: Exploring HTTP/1.0, 1.1 and 2.0
Cory Forsyth
 
An Introduction To REST API
Aniruddh Bhilvare
 
The Evolving Security Environment For Web Services
Qanita Ahmad
 
KMUTNB - Internet Programming 2/7
phuphax
 
HTTP Basics Demo
InMobi Technology
 
Resource-Oriented Web Services
Bradley Holt
 
The Top Tips You need to Learn about Data in your Mobile App
Woodruff Solutions LLC
 
zendframework2 restful
tom_li
 
Messaging for Real-time WebApps
Tiju John
 
Rest WebAPI with OData
Mahek Merchant
 
Module 5.pptx HTTP protocol on optical and wireless communication
chandushivamurthy4
 
Http_Protocol.pptx
Abshar Fatima
 
Ad

Testing REST Web Services