Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Frisby.js an API testing tool built on top of Jest that makes testing API endpoints easy, fast and fun.
Install Frisby v2.x from NPM into your project:
npm install frisby --save-dev
The minimum setup to run a single test expectation.
const frisby = require('frisby');
it('should be a teapot', function () {
// Return the Frisby.js Spec in the 'it()' (just like a promise)
return frisby.get('http://httpbin.org/status/418')
.expect('status', 418);
});
A more complex example with nested dependent Frisby tests with Frisby's Promise-style then
method.
const frisby = require('frisby');
const Joi = frisby.Joi; // Frisby exposes Joi for convenience
describe('Posts', function () {
it('should return all posts and first post should have comments', function () {
return frisby.get('http://jsonplaceholder.typicode.com/posts')
.expect('status', 200)
.expect('jsonTypes', '*', {
userId: Joi.number(),
id: Joi.number(),
title: Joi.string(),
body: Joi.string()
})
.then(function (res) { // res = FrisbyResponse object
let postId = res.json[0].id;
// Get first post's comments
// RETURN the FrisbySpec object so function waits on it to finish - just like a Promise chain
return frisby.get('http://jsonplaceholder.typicode.com/posts/' + postId + '/comments')
.expect('status', 200)
.expect('json', '*', {
postId: postId
})
.expect('jsonTypes', '*', {
postId: Joi.number(),
id: Joi.number(),
name: Joi.string(),
email: Joi.string().email(),
body: Joi.string()
});
});
});
});
Frisby comes with many handy built-in expect handlers to help you test the HTTP response of your API.
status
- Check HTTP statusheader
- Check HTTP header key + valuejson
- Match JSON structure + values (RegExp can be used)jsonStrict
- Match EXACT JSON structure + values (extra keys not tested for cause test failures)jsonTypes
- Match JSON structure + value typesjsonTypesStrict
- Match EXACT JSON structure + value types (extra keys not tested for cause test failures)bodyContains
- Match partial body content (string or regex)responseTime
- Check if request completes within a specified duration (ms)When Frisby's built-in expect handlers are not enough, or if you find yourself running the same expectations in multiple places in your tests, you can define your own custom expect handler once, and then run it from anywhere in your tests.
beforeAll(function () {
// Add our custom expect handler
frisby.addExpectHandler('isUser1', function (response) {
let json = response.body;
// Run custom Jasmine matchers here
expect(json.id).toBe(1);
expect(json.email).toBe('testy.mctesterpants@example.com');
});
});
// Use our new custom expect handler
it('should allow custom expect handlers to be registered and used', function () {
return frisby.get('https://api.example.com/users/1')
.expect('isUser1')
});
afterAll(function () {
// Remove said custom handler (if needed)
frisby.removeExpectHandler('isUser1');
});
With Frisby, you can use Joi to set the expectation that the JSON body response from the HTTP call meets a defined schema. Check out the Joi API for more details.
Any of the Jasmine matchers
can be used inside the then
method to perform additional or custom tests on
the response data.
const frisby = require('frisby');
it('should be user 1', function () {
return frisby.get('https://api.example.com/users/1')
.then(function (res) {
expect(res.json.id).toBe(1);
expect(res.json.email).toBe('testy.mctesterpants@example.com');
});
});
Frisby uses Jasmine style assertion syntax, and uses Jest to run tests.
Jest can run sandboxed tests in parallel, which fits the concept of HTTP testing very nicely so your tests run much faster.
npm install --save-dev jest
mkdir __tests__
touch __tests__/api.spec.js
cd your/project
jest
Documentation is hosted at frisbyjs.com, the documentation pages has separate repository.
Licensed under the BSD 3-Clause license.
FAQs
Frisby.js v2.0: REST API Endpoint Testing built on Jasmine
The npm package frisby receives a total of 12,735 weekly downloads. As such, frisby popularity was classified as popular.
We found that frisby demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.