
Security News
Feross on Risky Business Weekly Podcast: npm’s Ongoing Supply Chain Attacks
Socket CEO Feross Aboukhadijeh joins Risky Business Weekly to unpack recent npm phishing attacks, their limited impact, and the risks if attackers get smarter.
API validator in BDD style with Cucumber. cucumber-api lets one validate public APIs JSON response in blazingly fast time.
Inspired by cucumber-api-steps.
Checkout sample to see cucumber-api in action.
Add cucumber-api
gem to your Gemfile
:
gem 'cucumber-api'
Require cucumber-api
in your Cucumber's env.rb
:
require 'cucumber-api'
Verbose logging: enable verbose logging of API calls and responses by setting cucumber_api_verbose=true
in your ENV
, preferably via your cucumber.yml
# config/cucumber.yml
##YAML Template
---
verbose : cucumber_api_verbose=true
Preparation steps
Specify your request header's Content-Type
and Accept
. The only supported option for Accept
is application/json
at the moment.
Given I send and accept JSON
Given I send "(.*?)" and accept JSON
You could also others header's information like:
Given I send and accept JSON
And I add Headers:
| name1 | value |
| name2 | other |
Specify POST body
When I set JSON request body to '(.*?)'
When I set form request body to:
| key1 | value1 |
| key2 | {value2} |
| key3 | file://path-to-file |
When I set JSON request body to:
"""
{
"key1": "jsonString",
"key2": 1
}
"""
Or from YAML/JSON file
When I set request body from "(.*?).(yml|json)"
Example:
Given I send "www-x-form-urlencoded" and accept JSON
When I set JSON request body to '{"login": "email@example.com", "password": "password"}'
When I set form request body to:
| login | email@example.com |
| password | password |
When I set request body from "data/json-data.json"
When I set request body from "data/form-data.yml"
Request steps
Specify query string parameters and send an HTTP request to given URL with parameters
When I send a (GET|POST|PATCH|PUT|DELETE) request to "(.*?)"
When I send a (GET|POST|PATCH|PUT|DELETE) request to "(.*?)" with:
| param1 | param2 | ... |
| value1 | value2 | ... |
Temporarily save values from the last request to use in subsequent steps in the same scenario:
When I grab "(.*?)" as "(.*?)"
Optionally, auto infer placeholder from grabbed JSON path:
# Grab and auto assign {id} as placeholder
When I grab "$..id"
The saved value can then be used to replace {placeholder}
in the subsequent steps.
Example:
When I send a POST request to "http://example.com/token"
And I grab "$..request_token" as "token"
And I grab "$..access_type" as "type"
And I grab "$..id"
And I send a GET request to "http://example.com/{token}" with:
| type | pretty |
| {type} | true |
Then the JSON response should have required key "id" of type string and value "{id}"
Assume that http://example.com/token have an element {"request_token": 1, "access_type": "full", "id": "user1"}
, cucumber-api will execute the followings:
request_token
, access_type
and id
from JSON response and save it for subsequent steps"id": "user1"
This will be handy when one needs to make a sequence of calls to authenticate/authorize API access.
Assert steps
Verify:
Then the response status should be "(\d+)"
Then the JSON response should follow "(.*?)"
Then the JSON response root should be (object|array)
Then the JSON response should have key "([^\"]*)"
Then the JSON response should have (required|optional) key "(.*?)" of type (numeric|string|boolean|numeric_string|object|array|any)( or null)
Then the JSON response should have (required|optional) key "(.*?)" of type (numeric|string|boolean|numeric_string|object|array|any)( or null) and value "(.*?)"
Example:
Then the response status should be "200"
Then the JSON response should follow "features/schemas/example_all.json"
Then the JSON response root should be array
Then the JSON response should have key "id"
Then the JSON response should have optional key "format" of type string or null
Then the JSON response should have required key "status" of type string and value "foobar"
Also checkout sample for real examples. Run sample with the following command:
cucumber -p verbose
Response caching is provided for GET requests by default. This is useful when you have a Scenario Outline or multiple Scenarios that make GET requests to the same endpoint.
Only the first request to that endpoint is made, subsequent requests will use cached response. Response caching is only available for GET method.
The response cache can also be cleared if needed:
Given I clear the response cache
FAQs
Unknown package
We found that cucumber-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Socket CEO Feross Aboukhadijeh joins Risky Business Weekly to unpack recent npm phishing attacks, their limited impact, and the risks if attackers get smarter.
Product
Socket’s new Tier 1 Reachability filters out up to 80% of irrelevant CVEs, so security teams can focus on the vulnerabilities that matter.
Research
/Security News
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.