How do you automate testing a web applications server side input validation?

Question

When testing web applications I often write automated browser tests to test input field validation rules are enforced (not allowing the user to input dodgy data) and the appropriate messages are displayed to them.

How do you conduct the equivalent types of test but bypassing the client side validation so that the server side validation is tested?

I've done these kind of tests manually in the past by replaying a post request in fiddlr with different values. I'd really like to know if there's a good automated way of doing this so that I can include the tests in an automated regression pack to be run regularly.

This is specifically for a ruby on rails application in this case but I think this might be a language agnostic question.

Answer 1

There are many different ways to do this, depending on the tools you have available and the way your server-side code runs.

• If you have a means to interact with the server via API, you can use that to test server side validation.
• Alternatively, you can use tools like Fiddlr to directly send parameters and parse responses.
• Some of the load-testing tools will allow you to do this by sending values through HTTP and returning the responses.
• If you know enough html or have the ability to disable your application's client-side validation, you can use the client to send your unvalidated data and verify the results.
• Depending on the browser, you may be able to use the built-in browser developer tools to send requests and process responses.

There are other options, too - this is just what comes to mind immediately.

Answer 2

I never used it that way, but I guess you can do that with JMeter.

Maybe this ?

Answer 3

The way we test server-side validation is to disable the client-side validation through javascript. Not sure which testing framework you are using but the following example works in Selenium.

var javaScriptExecutor = (IJavaScriptExecutor)driver;
javaScriptExecutor
    .ExecuteScript("$('form').attr('novalidate', 'novalidate');");

Answer 4

To complete, if your UI is connected to your backend throw webservices I recommend you to use SoapUI. It is very easy to use and you can quickly automatize your tests:
- Parse the webservice URL to SoapUI
--> It will display the list of methods (commands) visible
- Click on one of the methods you want to test
--> SoapUI will display the XML used empty
- Fulfill the XML tag you need and push play

Then you can record what you did as a test and add validations.
If you need you can go deeper using your SoapUI project with JUnit or TestNG to get more flexibility in your test.

Answer 5

A few ways I would attempt this.

• VIA Javascript injection within the Chrome/Firefox console
• Using POSTMan to build the request
• Using SoapUI to build the request
• Disabling JavaScript in the browser
• Using outdated browsers which the functions might be incompatible with

There is several other methods, if you want to automate your best options would be by sending raw HTTP Requests though. SoapUI, PostMan, Fiddler or several other utilities or custom built tools can achieve this.