Is it neccessary to consider the front end while testing backend?

Question

Now I am writing tests for django application and it is very confusing task. Since I am working for some other person, I need to have complete test cases in my test. I have some doubts; please help me.

In the front end, I have a html input which is having type number and label frequency.

In the back end, I will read the value in frequency field using following.

freq=request.POST['frequency']

Here I haven't considered a test case in which frequency field having invalid value ( i.e, a character instead of number ).

Is it necessary to consider above mentioned testcase?

Since in the front end, it is already limited to number input and hence user will not be allowed to enter characters.

Important thing is, I am doing the white box testing and not black box testing.

Answer 1

Back-end should be tested separately regardless of test results on the front-end. The main reason would be security. It's great that you have tested that front-end can send to back-end only numbers, but what if some person purposely use intercepting tool and forge request send to your back-end and change the number to any other naughty value? This may cause an error in an application and may expose sensitive information. It's only one example but there are much more, and not only regarding inputs. Testing validation on the front-end part of an application is not enough.

Answer 2

If you're responsible for testing the entire solution then you have to consider all the components which compose that solution. If you are responsible for only back-end testing then you should concentrate on the back-end and do not care of any integrational aspects. In the latter case just leave that headache to the people who are put in charge of integration level testing.

Answer 3

Is it necessary to consider inputs that the front end blocks when testing the back end?

The short answer is YES.

The reason the answer is yes is because it is trivial for anyone with a little knowledge to bypass the front-end validation and send invalid data to the back end. It can be done with the tools built in to every browser, not to mention any proxy tool.

As a general rule, any data that comes from the front end of a system is untrusted and should be checked at the back end regardless of any front-end validation you are performing.

This is probably one of the simplest ways to prevent security issues in an application, but also one of the most neglected. I'd recommend a tour through the OWASP site, particularly the Top 10 for more information on the issues that can happen if you don't test for input validation on the back end as well as the front end.

(I am not affiliated with OWASP. I consider them an essential reference for web testers)

Answer 4

If your job is white box testing, forget front end, just test the code for every type of input

Not much I can think of. But consider a scenario where because of some reason the UI control is not restricted to numbers only. In that case, application backend will act as a second line of defense.