How to perform password enryption and multiple browser configuration?

Question

For login page: I need to login with username and password, I should pass the password in encrypted format. While so I would need to save the password encrypted in test data. While sending password to that field I should decrypt and send that in selenium script. it is necessary. Any secret key or password must be encrypted with any logic.

Security is the most important thing. Password should be in encrypted form. Cross-browser: How to perform cross browser testing

Anybody please help me to perform password encryption and multiple browser configuration:

package util;

import org.openqa.selenium.WebDriver;
import org.openqa.selenium.chrome.ChromeDriver;


/**
 * Created by naveen on 29/11/16.
 */
public class DriverManager {
    public static WebDriver driver;
    String baseUrl="http://qmsadm/";
    public DriverManager()
    {

        System.setProperty("webdriver.chrome.driver","/home/naveen/chromedriver");
        driver=new ChromeDriver();
        driver.get(baseUrl);
        driver.manage().window().maximize();

    }

}

package login;


import org.testng.annotations.*;

import org.testng.Assert;
import pageobjects.HomePage;
import steps.LoginSteps;
import util.DriverManager;

public class loginTest2
{
    @BeforeSuite(groups = {"regression"})
    public void initDriver(){
        DriverManager manager = new DriverManager();
    }    

    @Parameters({"userName","password"})
    @Test
    public void verifyValidLogintoSpree(String userName, String password)
    {
        LoginSteps loginSteps = new LoginSteps();
        HomePage expected_message=loginSteps.Login(userName,password);
        Assert.assertEquals(expected_message,"MY ACCOUNT");

    }
}

testng.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE suite SYSTEM "http://testng.org/testng-1.0.dtd">
        <suite name="Regression">

        <parameter name="userName" value="geosony"/>
        <parameter name="password" value="1"/>
    <test name="regression">
        <groups>
            <run>
                <include name="regression"/>
                <exclude name="sanity"/>
            </run>
        </groups>
        <classes>
            <class name="login.loginTest"/>

        </classes>
    </test>
</suite>

Answer 1

Instead of putting the password hardcoded (encrypted or not) in the test-data I would create a test-user for each separate test-run with a random-password only known to the test-run.

Simplest way is to insert a new user into the database similar as the application would do from the management views. I would ask my developers to help me with this as they know how the management views create the users. Preferable I would let the tests re-use the same code.

Also you could block access to the test-environment from the internet. Let say only accessable from the developers desktops and continuous integration servers. If so I really do not see an issue with putting a password in a text-file really.

Encryption will not help as the decryption key also needs to be included in the code. Or in a separate file which you need to share with everyone who wants to run the test, including any servers. Here is some code for Java to en/de-crypt a string: https://stackoverflow.com/questions/4487525/encrypt-and-decrypt-a-string-in-java Store the SecretKey in a config file you read from disk and don't commit this file to the source code or else anyone can decrypt it again. This separate file thing feels like to much work if you ask me.

Answer 2

Note that no matter what tool or software you are using (Selenium, Webdriver, Ranorex, Kantu Browser,...), all passwords must be decrypted before sending them to the web browser. At this point any malicious person/hacker/tool can view them in plain text. Here is one way how to do it.

So passwords used for web testing are never secure, they are obfuscated at best (= making it a bit harder to steal, but not impossible).

Answer 3

Please use the below utility to encrypt and decrypt the test data , easy to use and effective when working with the shared data :

https://youtu.be/A6CPmKUAmT4