WO2021027615A1

WO2021027615A1 - Test method and device for web service interface having authentication authorization

Info

Publication number: WO2021027615A1
Application number: PCT/CN2020/106707
Authority: WO
Inventors: 李登宇
Original assignee: 中国建设银行股份有限公司; 建信金融科技有限责任公司
Priority date: 2019-08-09
Filing date: 2020-08-04
Publication date: 2021-02-18
Also published as: CN110442524A; CN110442524B

Abstract

Disclosed are a test method and device for a web service interface having authentication authorization, relating to the technical field of computers. One specific embodiment of the method comprises: respectively establishing login scripts for tested systems; dynamically loading the login script corresponding to a tested system under test according to an association relationship between the tested systems and the login scripts and executing same, so as to simulate to log on the tested system under test to obtain authentication information; and supplying the authentication information to an interface test tool so as to add the authentication information to an interface access request for the tested system under test, and performing verification on response data returned by the tested system under test. The specific embodiment is suitable for automatically testing the web service interface of the tested system having authority control, avoids too large invasiveness to the system, reduces errors, does not need for manual configuration of authentication authorization information, improves automation efficiency, is high in expandability, can achieve multi-user multi-role login, guarantees interface test sufficiency, does not need for restarting, and improves system availability.

Description

Method and device for testing web service interface with authentication and authorization

Technical field

The present invention relates to the field of computer technology, in particular to a method and device for testing web service interfaces with authentication and authorization.

Background technique

Software testing is an important part of the software life cycle and an important process to ensure the correctness, ease of use, security, and integrity of business functions. Among them, the interface test is a kind of test started in the middle and late stages of the business function development phase, and its purpose is to test the correctness of data exchange, transmission and control in the communication between system components.

In the implementation of the interface test of the web application system, the tester needs to use a tool to simulate a web browser to send a request to the back-end service, and to check the response message. For systems that need to log in, two solutions are generally used: one is to turn off the login authentication from the backend, and the other is to manually obtain a usable cookie (data stored on the user's local terminal) or token (token) each time, In subsequent access requests, bring these authentication information. The first solution is not applicable to systems with permission control, because different login users may have different permissions, and some business logic requires permission verification. This method of directly turning off permissions invades the system It is too flexible to test the business logic that includes permission control, and the server needs to be deployed separately, which will also bring unexpected errors; the second solution may be different for different interfaces, which may result in different authentication information, resulting in complicated management. In addition, authentication Information generally has an expiration time, so it needs to be replaced frequently. It is not suitable for automated testing scenarios.

In the process of implementing the present invention, the inventor found that at least the following problems exist in the prior art:

The existing technology is not suitable for automated testing of the web service interface of the system under test with authority control. It is too intrusive to the system, requires a separate deployment of the server, and also brings unexpected errors, and has poor scalability for different systems under test. And multi-user login is not supported, and the adequacy of interface testing cannot be guaranteed.

Summary of the invention

In view of this, the embodiments of the present invention provide a method and device for testing web service interfaces with authentication and authorization, which can be adapted to automate testing of web service interfaces of the system under test with permission control, and overcome excessive intrusiveness to the system. Large defects, no need to deploy servers separately, reduce errors, provide effective authentication and authorization information for automated test tools without manual configuration every time, improve automation efficiency, and ensure high scalability for different systems under test. Support Multi-user and multi-role logins ensure the adequacy of interface testing, and load the login script of the newly tested system without restarting, which improves system availability.

To achieve the above objective, according to one aspect of the embodiments of the present invention, a method for testing a web service interface with authentication and authorization is provided.

A method for testing web service interfaces with authentication and authorization includes: establishing login scripts for each system under test, and saving the association relationship between the system under test and the login script; upon receiving the interface test tool After the login request for the tested system under test is sent, the login script corresponding to the tested system under test is dynamically loaded and executed according to the association relationship to simulate logging in to the tested system under test to obtain the test The authentication information provided by the system under test; the authentication information is provided to the interface test tool, so that the interface test tool adds the authentication information to the interface access request to the tested system under test, Furthermore, the response data returned by the tested system in response to the interface access request is verified.

Optionally, the method further includes: after establishing a login script for the system under test, configuring one or more sets of input parameters of the login script, and each set of input parameters is a set of login user information of the system under test.

Optionally, the login request includes the name of the tested system under test specified by the interface test tool and the login user information, and the login script corresponding to the tested system under test is dynamically loaded and executed according to the association relationship, to The step of simulating logging in to the tested system under test to obtain the authentication information provided by the tested system under test includes: searching for a login script that has a mapping relationship with the name of the tested system under test, and loading the login script ; Use the login user information specified by the interface test tool as the input parameter of the loaded login script, execute the loaded login script to simulate logging in to the tested system under test, after the login is successful, the login The script parses the authentication information from the response message returned by the tested system under test.

Optionally, the web login process of the tested system is abstracted as a java (an object-oriented programming language) login interface, and the login script implements the java login interface according to the login logic of the tested system to complete the Simulated login of the system under test.

Optionally, a java class loader is used to dynamically load the login script corresponding to the tested system under test.

Optionally, the authentication information is token or session (session control) information.

According to another aspect of the embodiments of the present invention, a device for testing a web service interface with authentication and authorization is provided.

A testing device for a web service interface with authentication and authorization, comprising: a login script creation module, which is used to create login scripts for each tested system and save the association relationship between the tested system and the login script The login script loading and execution module is used to dynamically load the login script corresponding to the tested system under test according to the association relationship after receiving the login request for the tested system under test sent by the interface test tool and Execute to simulate logging in the tested system under test to obtain the authentication information provided by the tested system under test; the authentication information providing module is used to provide the authentication information to the interface test tool so that the The interface test tool adds the authentication information to the interface access request to the tested system under test, and then verifies the response data returned by the tested system in response to the interface access request.

Optionally, it further includes an input parameter configuration module, which is used to configure one or more sets of input parameters of the login script after the login script is established for the system under test, and each set of input parameters is a set of the system under test. Login user information.

Optionally, it further includes an information receiving module, configured to receive the name of the tested system and login user information specified by the interface test tool, and the login script loading and execution module is also used to: The name of the tested system under test has a login script with a mapping relationship, and the login script is loaded; using the login user information specified by the interface test tool as the input parameter of the loaded login script, the loaded login script is executed to simulate Log in to the tested system under test, and after the login is successful, the login script parses out the authentication information from the response message returned by the tested system under test.

Optionally, the web login process of the system under test is abstracted as a java login interface, and the login script implements the java login interface according to the login logic of the system under test to complete the simulated login to the system under test .

Optionally, the login script loading and execution module uses a java class loader to dynamically load the login script corresponding to the tested system under test.

According to another aspect of the embodiments of the present invention, an electronic device is provided.

An electronic device, comprising: one or more processors; a memory, used to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more Multiple processors implement the method for testing web service interfaces with authentication and authorization provided by the present invention.

According to still another aspect of the embodiments of the present invention, a computer-readable medium is provided.

A computer-readable medium with a computer program stored thereon, and when the program is executed by a processor, the method for testing a web service interface with authentication and authorization provided by the present invention is realized.

An embodiment of the above-mentioned invention has the following advantages or beneficial effects: establish login scripts for each system under test, and save the association relationship between the system under test and the login script; after receiving the test data sent by the interface test tool After the login request of the tested system, the login script corresponding to the tested system is dynamically loaded and executed according to the association relationship to simulate the login test of the tested system to obtain the authentication information provided by the tested system; provide the authentication information to The interface test tool adds the authentication information to the interface access request of the tested system by the interface test tool, and then verifies the response data returned by the tested system in response to the interface access request. It is suitable for automated testing of the web service interface of the system under test with access control, overcoming the defect that is too intrusive to the system, without the need to deploy a server separately, reducing the occurrence of errors, and providing effective authentication and authorization information for automated testing tools. It needs to be manually configured each time to improve automation efficiency, support user-defined login scripts, abstract the login interface and implement the login interface for each system under test to ensure high scalability for different systems under test. Multiple groups of login user information can be configured to support multi-user and multi-role login, ensuring the sufficiency of interface testing. In addition, the java class loader is used to dynamically load the login script corresponding to the tested system, so there is no need to restart the device of the present invention. The login script of the tested system can be loaded for the new test, which improves the system usability.

The further effects of the above non-conventional alternative methods will be described below in conjunction with specific implementations.

Description of the drawings

The accompanying drawings are used to better understand the present invention, and do not constitute an improper limitation of the present invention. among them:

FIG. 1 is a schematic diagram of the main steps of a method for testing a web service interface with authentication and authorization according to a first embodiment of the present invention;

Figure 2 is a schematic diagram of a login authentication authorization process of a system under test according to a second embodiment of the present invention;

3 is a schematic diagram of main modules of a web service interface testing device with authentication and authorization according to a third embodiment of the present invention;

4 is a schematic diagram of system interaction for testing web service interface with authentication and authorization according to a fourth embodiment of the present invention;

FIG. 5 is an exemplary system architecture diagram to which the embodiment of the present invention can be applied;

Fig. 6 is a schematic structural diagram of a computer system suitable for implementing a terminal device or a server according to an embodiment of the present invention.

detailed description

The following describes exemplary embodiments of the present invention with reference to the accompanying drawings, which include various details of the embodiments of the present invention to facilitate understanding, and should be regarded as merely exemplary. Therefore, those of ordinary skill in the art should realize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present invention. Also, for clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

Those skilled in the art know that the embodiments of the present invention can be implemented as a system, device, device, method, or computer program product. Therefore, the present disclosure may be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

Fig. 1 is a schematic diagram of the main steps of a method for testing a web service interface with authentication and authorization according to a first embodiment of the present invention.

As shown in FIG. 1, the method for testing a web service interface with authentication and authorization in this embodiment mainly includes the following steps S101 to S103.

Step S101: Establish a login script for each system under test, and save the association relationship between the system under test and the login script.

The tested system may specifically be a web application system.

The embodiment of the present invention abstracts the web login process of the system under test as a java login interface, and each login script implements the java login interface according to the login logic of the associated system under test to complete the simulated login of the corresponding system under test. Specific implementation logic such as: using httpClient development kit (which can be used to provide efficient, up-to-date, feature-rich client programming toolkit supporting HTTP protocol) to simulate the page to submit web login request, or htmlUnit (an open source java page) Analysis tool, after reading the page, you can effectively use htmlUnit to analyze the content on the page) The development kit simulates the browser to parse the web login page to log in to the system under test. After the login is successful, the login authentication and authorization information is analyzed, and the It is encapsulated into Map (a container that associates key objects with value objects) and returns. Thus, each system under test can implement its own login script.

It should be noted that the above httpClient development kit and htmlUnit development kit can also be replaced with other java development tools that can simulate sending http requests. The java development tool sends a web login request to the tested system, receives and processes the response returned by the tested system Message to parse out the login authentication and authorization information and encapsulate it into a Map. The login script can also be called a java login script.

The authentication and authorization information parsed above can be referred to as authentication information for short, and the authentication information provided by the system under test can be obtained by executing the login script of a certain system under test.

After establishing a login script for a tested system, it also includes: configuring one or more sets of input parameters of the login script, and each set of input parameters is a set of login user information of the tested system.

The input parameters of the login script of a tested system, that is, the input parameters of the java login interface implemented by the login script, can be in the form of a String array, which includes the user name and password information required to log in to the tested system.

Step S102: After receiving the login request for the tested system under test sent by the interface test tool, according to the association relationship between the tested system and the login script, dynamically load and execute the login script corresponding to the tested system under test. Log in to the system under test to simulate the authentication information provided by the system under test.

The login request includes the name of the tested system designated by the interface test tool and the login user information. The tested system under test is the system under test currently to be executed interface test.

Step S102 may specifically include: searching for a login script that has a mapping relationship with the name of the tested system under test, and loading the login script; using the login user information specified by the interface test tool as the input parameter of the loaded login script, and executing the loaded login Script to simulate the system under test for login test. After the login is successful, the login script parses the authentication information from the response message returned by the system under test under test.

After parsing out the authentication information, the authentication information is stored in the Map and then returned to the interface test tool.

Among them, the java class loader can be used to dynamically load the login script corresponding to the tested system.

The authentication information can be token; or session information, such as session ID (identification); or other information that can be used for authentication and authorization.

Step S103: Provide the authentication information to the interface testing tool, so that the interface testing tool adds the authentication information to the interface access request to the tested system under test, and then responds to the response data returned by the tested system in response to the interface access request Perform verification.

After the interface test tool adds the authentication information to the interface access request to the tested system under test, the interface access request is sent to the tested system under test, and the tested system under test responds to the interface access request and returns the response data to Interface test tool so that the interface test tool can verify the returned response data. The verification of the above response data returned by the tested system is mainly to verify the check points in the response data. Checkpoints are test points for interface testing, such as certain fields in the response data. The verification can be to check whether these fields meet expectations.

Fig. 2 is a schematic diagram of the login authentication authorization process of the system under test according to the second embodiment of the present invention.

As shown in Figure 2, the embodiment of the present invention abstracts the web login process of the system under test as a java login interface, for example: login(String[]) login interface. Establish the login script of the tested system (denoted as A system): A.class. The login script implements the login(String[]) login interface according to the login logic of the A system to simulate logging in to the A system.

For login management of the system under test, you can create a new system under test on the UI interface (user interface), such as the A system mentioned above, and upload the established login script A.class to establish the A system and the login script A.class For example, establish the following mapping relationship between the name of the A system and the login script A.class:

Save the mapping relationship. Configure multiple groups of login user information, each group of login user information is a set of input parameters of the login(String[]) login interface implemented by the login script A.class. E.g:

Administrator: login("admin","admin")

Approver: login("verify","verify")

For each system under test, you can configure multiple sets of login user information according to the above method according to different role information in its back-end services (such as administrator, approver, etc.), and name each set of login user information, for example "administrator".

Take the login authentication and authorization of system A as an example, the interface test tool specifies the name of system A and login user information, such as login: A, administrator. In addition, specify the interface of system A to be accessed, for example, interface: B111. Receive the login request to the A system sent by the interface test tool. The login request includes information such as A and the administrator. The administrator names the login user information. Through this naming, you can know that the user name of the specified A system is "admin" , The password is "admin". According to the mapping relationship:

Find the login script A.class that has a mapping relationship with A, and dynamically load and execute the login script A.class through ClassLoader (class loader). The login script A.class implements the login(String[]) login interface to simulate login to the A system. The current input parameters of the login(String[]) login interface are the username and password of the A system specified above, namely: login( "admin","admin").

The authentication information Token=111 is obtained by executing the login script A.class, which is provided by the A system after the login script A.class is executed to simulate logging in to the A system. The Token is returned to the interface testing tool, and the interface testing tool adds it to the interface access request to the A system to complete the login authentication and authorization process for the A system.

Fig. 3 is a schematic diagram of main modules of a web service interface testing device with authentication and authorization according to a third embodiment of the present invention.

As shown in FIG. 3, the web service interface testing device 300 with authentication and authorization according to the embodiment of the present invention, hereinafter referred to as the web service interface testing device 300, mainly includes: a login script establishment module 301, a login script loading and execution module 302, Authentication information providing module 303.

The login script creation module 301 is used to create login scripts for each tested system and save the association relationship between the tested system and the login script.

The tested system may specifically be a web application system.

The embodiment of the present invention can abstract the web login process of the system under test as a java login interface, and each login script implements the java login interface according to the login logic of the associated system under test to complete the simulated login of the associated system under test.

The web service interface testing device 300 may also include an input parameter configuration module. After the login script creation module 301 creates a login script for the system under test, the input parameter configuration module can be used to configure one or more sets of input parameters of the login script. The group input parameter is a group of login user information of the system under test. In the web service interface testing device 300, for each system under test, multiple sets of login account information can be configured according to role information.

The login script loading and execution module 302 is used to dynamically load the tested system according to the association relationship between the tested system and the login script after receiving the login request for the tested system under test sent by the interface test tool The corresponding login script is executed to simulate the system under test of the login test, and the authentication information provided by the system under test is obtained.

The web service interface testing device 300 may further include an information receiving module for receiving the name of the tested system and the login user information specified by the interface testing tool.

The login script loading and execution module 302 can be specifically used to: find a login script that has a mapping relationship with the name of the tested system under test, and load the login script; use the login user information specified by the interface test tool as the input of the loaded login script Parameters, execute the loaded login script to simulate the system under test in the login test. After the login is successful, the login script parses the authentication information from the response message returned by the tested system under test.

The authentication information may specifically be Token; or session information, such as session ID; or other authentication and authorization information. Web application systems usually have authentication and authentication modules to ensure the security of software system data. Authentication is a process in which a user enters identity information, the server performs verification, and returns the verification result, that is, whether the user is a legitimate user. Authentication is the verification of whether a user has permission to access the back-end service after logging in, that is, whether a legitimate user has the right to operate.

The login script loading and execution module 302 may use a java class loader to dynamically load the login script corresponding to the tested system.

The authentication information providing module 303 is used to provide authentication information to the interface test tool, so that the interface test tool adds the authentication information to the interface access request to the tested system under test, and then responds to the interface access request to the tested system under test The returned response data is verified.

The web service interface testing device of the embodiment of the present invention abstracts the login interface, implements the login interface for each system under test, and completes the simulated login to the system under test in the implementation, which has high scalability and is in use. , The interface testing tool sends a login request to the web service interface testing device 300 of this embodiment, specifying the user name used to return the login authentication information. In addition, the web service interface testing device of this embodiment uses java ClassLoader to dynamically load the The login script of the tested system can be loaded without restarting the device of this embodiment to complete the loading of the login script of the new tested system, ensuring high availability of the device.

Figure 4 is a schematic diagram of system interaction for web service interface testing with authentication and authorization according to a fourth embodiment of the present invention.

As shown in FIG. 4, the web service interface test with authentication and authorization in the embodiment of the present invention includes three parts of interaction, namely, the web service interface testing device with authentication and authorization in the embodiment of the present invention (hereinafter referred to as web service interface). The interaction between the test device), the interface test tool, and the system under test. The web service interface testing device with authentication and authorization can work with automated testing tools to provide effective authentication and authorization information for automated testing tools without manual configuration each time, thereby improving automation efficiency.

The interaction process is as follows:

Step S401: The web service interface testing device establishes login scripts for each system under test, and saves the association relationship between the system under test and the login script.

Step S402: The web service interface testing device configures input parameters of each login script, and the input parameters configured for each login script may be one or more groups.

Step S403: The interface testing tool sends a login request to the system under test (taking system A as an example) to the web service interface testing device.

Step S404: The web service interface testing device finds the login script of the A system according to the association relationship between the system under test and the login script.

Step S405: dynamically load and execute the found login script.

Step S406: Realize the simulated login to the A system.

Step S407: After the login is successful, the A system provides a Token to the web service interface testing device. Specifically, the Token is parsed from the response message (denoted as the first response message) returned by the A system by the login script.

Step S408: The web service interface testing device returns the Token to the interface testing tool.

Step S409: The interface test tool adds the Token to the interface access request to the A system.

Step S410: After receiving the interface access request, the A system runs the business logic of the A system, and some of the business logic uses the Token for permission verification.

Step S411: System A returns a response message (denoted as a second response message) to the interface testing tool.

Step S412: The interface test tool performs checkpoint verification on the second response message.

In addition, the specific implementation content of the web service interface testing device with authentication and authorization described in the embodiment of the present invention has been described in detail in the above-mentioned web service interface testing method with authentication and authorization, so here The repeated content will not be explained again.

FIG. 5 shows an exemplary system architecture 500 for a web service interface testing method with authentication and authorization or a web service interface testing apparatus with authentication and authorization to which an embodiment of the present invention can be applied.

As shown in FIG. 5, the system architecture 500 may include

terminal devices

501, 502, 503, a network 504, and a server 505. The network 504 is used to provide a medium for communication links between the

terminal devices

501, 502, 503 and the server 505. The network 504 may include various connection types, such as wired, wireless communication links, or fiber optic cables.

The user can use the

terminal devices

501, 502, 503 to interact with the server 505 via the network 504 to receive or send messages and so on. Various communication client applications, such as web browser applications, search applications, instant messaging tools, email clients, social platform software, etc., may be installed on the

terminal devices

501, 502, and 503 (only examples).

The

terminal devices

501, 502, and 503 may be various electronic devices that have a display screen and support web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and so on.

The server 505 may be a server that provides various services, such as a background management server (just an example) that provides support for websites browsed by users using the

terminal devices

501, 502, and 503. The background management server can process the received login request and other data, for example, log in to the system under test (not shown in Figure 5) according to the login request and get the response data returned by the system under test, analyze the response data, and perform processing, and The processing result (such as authentication information-just an example) is fed back to the terminal device.

It should be noted that the method for testing a web service interface with authentication and authorization provided by the embodiment of the present invention is generally executed by the server 505. Accordingly, the testing device for a web service interface with authentication and authorization is generally set in the server 505.

It should be understood that the numbers of terminal devices, networks, and servers in FIG. 5 are merely illustrative. According to implementation needs, there can be any number of terminal devices, networks and servers.

Reference is now made to FIG. 6, which shows a schematic structural diagram of a computer system 600 suitable for implementing a terminal device or a server in the embodiments of the present application. The terminal device or server shown in FIG. 6 is only an example, and should not bring any limitation to the function and use scope of the embodiments of the present application.

As shown in FIG. 6, the computer system 600 includes a central processing unit (CPU) 601, which can be based on a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603 And perform various appropriate actions and processing. The RAM 603 also stores various programs and data required for the operation of the system 600. The CPU 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. An input/output (I/O) interface 605 is also connected to the bus 604.

The following components are connected to the I/O interface 605: an input part 606 including a keyboard, a mouse, etc.; an output part 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and speakers, etc.; a storage part 608 including a hard disk, etc. ; And a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. The driver 610 is also connected to the I/O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that the computer program read from it is installed into the storage part 608 as needed.

In particular, according to the disclosed embodiments of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the disclosed embodiments of the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program may be downloaded and installed from the network through the communication part 609, and/or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present application are executed.

It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electric, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable Programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above. In this application, the computer-readable storage medium may be any tangible medium that contains or stores a program, and the program may be used by or in combination with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in a baseband or as a part of a carrier wave, and a computer-readable program code is carried therein. This propagated data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. The computer-readable signal medium may also be any computer-readable medium other than the computer-readable storage medium. The computer-readable medium may send, propagate, or transmit the program for use by or in combination with the instruction execution system, apparatus, or device . The program code contained on the computer-readable medium can be transmitted by any suitable medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation of the system architecture, functions, and operations of the system, method, and computer program product according to various embodiments of the present application. In this regard, each block in the flowchart or block diagram may represent a module, program segment, or part of code, and the above-mentioned module, program segment, or part of code contains one or more for realizing the specified logical function Executable instructions. It should also be noted that, in some alternative implementations, the functions marked in the block may also occur in a different order from the order marked in the drawings. For example, two blocks shown in succession can actually be executed substantially in parallel, or they can sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram or flowchart, and the combination of blocks in the block diagram or flowchart, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or can be It is realized by a combination of dedicated hardware and computer instructions.

The modules involved in the described embodiments of the present invention can be implemented in software or hardware. The described module may also be provided in the processor. For example, it may be described as: a processor includes a login script establishment module, a login script loading and execution module, and an authentication information providing module. Among them, the names of these modules do not constitute a limitation on the module itself under certain circumstances. For example, the login script creation module can also be described as "used to create login scripts for each system under test, and save the system under test. The module of the association relationship with the login script".

As another aspect, the present invention also provides a computer-readable medium. The computer-readable medium may be included in the device described in the foregoing embodiment; or it may exist alone without being assembled into the device. The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by a device, the device includes: establishing a login script for each system under test, and saving the system under test and The association relationship between the login scripts; after receiving the login request for the tested system under test sent by the interface testing tool, dynamically load the login script corresponding to the tested system under test according to the association relationship and execute , Log in to the tested system under test in a simulation to obtain the authentication information provided by the tested system under test; provide the authentication information to the interface test tool, so that the interface test tool can transfer the authentication information It is added to the interface access request for the tested system under test, and then the response data returned by the tested system in response to the interface access request is verified.

According to the technical solution of the embodiment of the present invention, a login script is established for each system under test, and the association relationship between the system under test and the login script is saved; after receiving the login to the system under test sent by the interface test tool After the request, the login script corresponding to the tested system under test is dynamically loaded and executed according to the association relationship to simulate the system under test for login test to obtain the authentication information provided by the tested system; the authentication information is provided to the interface test tool to The interface test tool adds the authentication information to the interface access request to the tested system, and then verifies the response data returned by the tested system in response to the interface access request. It is suitable for automated testing of the web service interface of the system under test with access control, overcoming the defect that is too intrusive to the system, without the need to deploy a server separately, reducing the occurrence of errors, and providing effective authentication and authorization information for automated testing tools. It needs to be manually configured each time to improve automation efficiency, support user-defined login scripts, abstract the login interface and implement the login interface for each system under test to ensure high scalability for different systems under test. Multiple groups of login user information can be configured to support multi-user and multi-role login, which ensures the adequacy of interface testing. In addition, the java class loader is used to dynamically load the login scripts corresponding to the tested system, so there is no need to restart the device of the present invention. The login script of the tested system can be loaded for the new test, which improves the system usability.

The foregoing specific implementations do not constitute a limitation on the protection scope of the present invention. Those skilled in the art should understand that, depending on design requirements and other factors, various modifications, combinations, sub-combinations, and substitutions can occur. Any modification, equivalent replacement and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

A testing method for web service interfaces with authentication and authorization includes:

Create a login script for each tested system, and save the association relationship between the tested system and the login script;

After receiving the login request for the tested system under test sent by the interface test tool, the login script corresponding to the tested system under test is dynamically loaded and executed according to the association relationship, so as to simulate the login script of the tested system under test. System to obtain the authentication information provided by the tested system under test;

The authentication information is provided to the interface test tool, so that the interface test tool adds the authentication information to the interface access request to the tested system under test, and then the test system under test The response data returned in response to the interface access request is verified.
The method according to claim 1, further comprising: after establishing a login script for the system under test, configuring one or more sets of input parameters of the login script, each set of input parameters being a set of login users of the system under test information.
The method according to claim 2, wherein the login request includes the name of the tested system under test specified by the interface test tool and login user information,

The step of dynamically loading and executing the login script corresponding to the tested system under test according to the association relationship to simulate logging in to the tested system under test, and obtaining the authentication information provided by the tested system under test includes:

Find a login script that has a mapping relationship with the name of the tested system under test, and load the login script;

The login user information specified by the interface test tool is used as the input parameter of the loaded login script, and the loaded login script is executed to simulate logging in to the tested system under test. After the login is successful, the login script The authentication information is parsed from the response message returned by the tested system under test.
The method according to claim 1, wherein the web login process of the system under test is abstracted as a java login interface, and the login script implements the java login interface according to the login logic of the system under test to complete the Describe the simulated login of the system under test.
The method according to claim 1, wherein a java class loader is used to dynamically load the login script corresponding to the tested system under test.
The method according to claim 1, wherein the authentication information is token or session information.
A testing device for a web service interface with authentication and authorization, the device comprising:

The login script creation module is used to create login scripts for each system under test, and save the association relationship between the system under test and the login script;

The login script loading and execution module is used to dynamically load and execute the login script corresponding to the tested system under test according to the association relationship after receiving the login request for the tested system under test sent by the interface test tool, Log in to the tested system under test by simulation to obtain the authentication information provided by the tested system under test;

The authentication information providing module is configured to provide the authentication information to the interface testing tool, so that the interface testing tool adds the authentication information to the interface access request to the tested system under test, and then The response data returned by the tested system in response to the interface access request is verified.
The device according to claim 7, further comprising an input parameter configuration module, configured to: after establishing a login script for the system under test, configure one or more sets of input parameters of the login script, and each set of input parameters is the A group of logged-in user information of the test system.
The device according to claim 8, further comprising an information receiving module, configured to receive the name of the tested system under test specified by the interface test tool and the login user information,

The login script loading and execution module is also used for:

Find a login script that has a mapping relationship with the name of the tested system under test, and load the login script;

The login user information specified by the interface test tool is used as the input parameter of the loaded login script, and the loaded login script is executed to simulate logging in to the tested system under test. After the login is successful, the login script The authentication information is parsed from the response message returned by the tested system under test.
The device according to claim 7, wherein the web login process of the system under test is abstracted as a java login interface, and the login script implements the java login interface according to the login logic of the system under test, and completes the Describe the simulated login of the system under test.
8. The device according to claim 7, wherein the login script loading and execution module uses a java class loader to dynamically load the login script corresponding to the tested system under test.
An electronic device including:

One or more processors;

Memory, used to store one or more programs,

When the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the method according to any one of claims 1-6.
A computer readable medium with a computer program stored thereon, which when executed by a processor implements the method according to any one of claims 1-6.