4

If you don't have specific requirements you should design test cases based on best practices, best user experience and security. It's not a bug, because it does not behave differently from expectations (you don't have any) but allowing to create password that is weak may lead to account hijacking and information leakage which is an issue. You have to think ...


3

Instead of putting the password hardcoded (encrypted or not) in the test-data I would create a test-user for each separate test-run with a random-password only known to the test-run. Simplest way is to insert a new user into the database similar as the application would do from the management views. I would ask my developers to help me with this as they ...


2

Since you don't have guidelines, you would have trouble justifying the behavior of the password field as a bug. That said, I'd suggest you raise a bug and classify it as a security flaw. You can cite the OWASP security standards password section to justify your case, even if the application isn't a web app: any software that needs a password by definition ...


1

Here is a workaround ... add config element HTTP Cookie Manager to ThreadGroup add HTTP Request sampler to ThreadGroup add Regular Expression Extractor Post Processor to HTTP Request sampler extract token with Regular Expression Extractor. use this token to send with password OR if you want to process password with token before send...use Preprocessor and ...


1

Here is how found a workaround for this problem, save the random challenge send by the server in Jmeter Process the random challenge at Jmeter by JavaScript / Bean Shell Scripting / by sending parameters to jar file Send the processed request to server server will set all the cookies & session at JMeter


1

Note that no matter what tool or software you are using (Selenium, Webdriver, Ranorex, Kantu Browser,...), all passwords must be decrypted before sending them to the web browser. At this point any malicious person/hacker/tool can view them in plain text. Here is one way how to do it. So passwords used for web testing are never secure, they are obfuscated at ...


Only top voted, non community-wiki answers of a minimum length are eligible