2

I'm using Selenium with Java to test a web application. The app requires a user to receive a One-Time Passcode (OTP) to authenticate they are, who they say they are and to authorize several critical transactions.

I have the automation code for the web application itself, but I need something methodology for the OTP, which is sent via SMS/text to a mobile device.

I know I need some API/Web service, that will emulate a phone, allow me to query it and return the message sent to it.

I have looked at Twilio and a few other such services, but they require you to start the process with them. Such as by sending an SMS to request an OTP, and then they will send back an OTP back for you to consume. But the app has its own OTP generator, so Twilio and such will not work for me.

Anyone have any suggestions or examples I can borrow?

Improve this question
4
  • Do any of the options here (stackoverflow.com/questions/47327117/…) help?
    – Kate Paulk
    Commented Sep 23, 2019 at 18:21
  • Cannot by-pass OTP, as that is part of the current testing and future regression tests. Do not have Appium. While I have my own cell phone, I would prefer a virtual phone that others can use as well.
    – Zaxxon
    Commented Sep 23, 2019 at 18:48
  • 2
    Any reason to not remove it via feature flags and test OTP separately? Login is a small portion of the usage of most apps - after the user has the access token, login systems do not enter in the scene.
    – João Farias
    Commented Sep 24, 2019 at 6:21
  • The OTP functionality also includes some other business function that needs to be tested. the OTP is configurable on/off but needs to be tested.
    – Zaxxon
    Commented Sep 25, 2019 at 18:42

3 Answers 3

Reset to default
2

Another option you could try is Google Voice (voice.google.com). This will give you a web interface to a phone number which is free for your first number.

I have used the app to test two factor authentication, so it should work for at least manual testing of your scenario.

Google allows you to have one number without charge, but you need to pay for any extra numbers.

Improve this answer
0

You can use the solution like https://play.google.com/store/apps/details?id=com.llamalab.automate so that you configure a Flow which monitors incoming SMS messages and dumpd them to a file. Then you mount file system of your phone to your pc where the tests are being executed (e.g. by pluging it via a cord) hence making your automated tests monitor the folder and parse data income.

Improve this answer
2
  • Wish to take the actual phone out of the picture, or not be dependent upon my phone.
    – Zaxxon
    Commented Sep 23, 2019 at 20:12
  • Im afraid it is hardly possible. You will need the device which would be registered in mobile network in order to accept SMS.
    – Alexey R.
    Commented Sep 23, 2019 at 20:15
0

You can add a key to store last OTP in an in-memory storage like Redis or closured Dictionary in your backend language, you will then update this key with the value of the OTP you want to send out via an SMS service provider. The last sent OTP stored in this key should then be exposed via an additional api endpoint in your service, which you would then call as part of your automated script after doing an action that will make the OTP to be sent.

A more reliable and robust modification of this will be to expose an API that retrieves the OTP stored against each phone number, you must have this stored already of course before you could do the verification in-app. This endpoint must only be exposed within a test environment, that's the precaution to pay attention to, or you make the endpoint available only to authorized user roles.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.