How to test oAuth Authentication?

Question

We are making a mobile application that will be communicating with the backend, which also we are building. Authorization of users and application itself with the backend is going to be made using oAuth2. Besides of testing the obvious cases like wrong user credentials, client id, secret etc. what are good test cases to test oAuth authentication? I was trying to find some ideas on the Internet but it wasn't much helpful.

Do you have any experience in this field and can suggest any weak spots? Any things worth to verify?

Answer 1

OAuth is a third party service. You should assume they test their core functionality so the remaining weak point is probably your implementation on which you should focus.

In cases like this I always recommend a heart to heart with the devs, they know what they struggled with and what might seem slightly hacky to them. Whatever you can get out of them( and getting it out might need some diplomatic skill) put it on the test charta.

Also put up a proxy and check what happens when the authentication service is down. Is it probably for all of e.g. Facebooks services to be down at the same time? Not really but I've seen implementations where really strange behavior surfaces once the service has gone away (could tell you a story about a series of bad decisions that resulted in an automatic login when the test env couldn't talk to the auth service) and you should know how your AUT behaves if it happens.

Also, if you work with automation be prepared for a world of pain. The login window will always open in its own sandbox and you have no control regarding what you get. Had a fun experience working against instagrams api once when they a/b tested their login. Nice 50/50 split of failing tests without changes in the AUT.