How to test 2-factor authentication (i.e. confirmation code) using selenium [closed]

Question

How can I automate Confirmation Code using Selenium ?

Update: Our web application ask for mobile number and pin for login and sends confirmation code in sms, which is then entered by user on Confirm Log On. PIN is matched against store value in Database. can be automated. But SMS confirmation code is generated on runtime

Answer 1

You have to prepare solution on developer's side. Possible solutions are:

1. All valid codes entered on the testing environment are OK.
2. The only specific code on the testing environment is OK.
3. Code simulator/reader is used to deliver the proper code to the testing script. You can then open this reader in another window, read the code, close window and use the code for authentication.

Personally, I like the 2. most. But both solutions 1. and 2. should be removed when an application goes to production. Therefore should be planned as removable, better than configurable. The goal is, that application does not have any possibility to enable it on production.

If you specify closer your problem, technologies, etc... If this is an SMS or RSA token, etc. I can give you further/more specific advice.

Update: for generated confirmation code from SMS all 3 variants can be applied.

4. (in compliance with 3.) If server side is under your control, you can try to read the SMS text on the server log or on SMS gateway, you can try to switch delivery channel on SMS gateway from SMS to mail etc.
5. Last, but a bit obscure, could be reading SMS trough testing tools in your physical smartphone. This could be used when you don't have any control of your server side.