Skip to content

Framework steps

Jump to bottom
Randy Gingeleski edited this page Apr 17, 2018 · 2 revisions

Cucumber Security Test Framework Step Defs

Given the application in an integration environment

  • Launches an ephemeral server of the application
  • Can mock out components of this on a scenario-by-scenario or test-by-test basis
  • Base URL is set automatically to the ephemeral server

Given the application up at "<baseUrl>"

  • Sets base URL for outgoing requests to the given string
  • Meant for end-to-end testing

Given the "<browserName>" as a headless client

  • Sets this scenario to be executed in a Selenium-wrapped headless browser
  • Acceptable parameters are "CHROME" or "FIREFOX"

When the user is authenticated with username "<username>" and password "<password>"

  • Starts a session with the given credentials
  • Preserves the cookie or authorization header for this scenario (session)
  • Will likely need to be customized by the test engineer to their application

When a "<method>" request is made to endpoint "<endpoint>"

  • Sets request method and the target URL as the endpoint appended to base URL
  • Base URL is derived from an earlier Given step
  • Acceptable method parameters are "GET", "POST", "PUT", or "DELETE"
  • Successive When steps can further build the request before it is executed

When the request body is "<requestBody>"

  • Sets POST or PUT request body to the given string
  • Does nothing if a GET or DELETE request is being prepared

When the request is "<specialAttribute>"

  • Ensures some special attribute of the request
  • Using "HTTP/1.0" as the parameter will execute the request as that instead of default HTTP/1.1

When request header "<headerName>" is set to "<headerValue>"

  • Adds a request header with the provided name and value

When the request does not have header "<headerName>"

  • Ensures a header with this name will not be on the request
  • Most applicable use case is keeping the Host header off the request

When the request cookie "<cookieName>" is set to "<cookieValue>"

  • Adds a request cookie with the provided name and value

Then the response should have status code <statusCode>

  • Asserts response is of the given status code

Then the response body should contain "<searchString>"

  • Asserts the response body includes the provided string

Then the response should have length <length>

  • Asserts the length of the response matches what's expected

Then the response should have header "<headerName>"

  • Asserts the response has a header with the provided name

Then the response should not have header "<headerName>"

  • Asserts the response does not have a header with the provided name

Then the response header "<headerName>" should be set to "<headerValue>"

  • Asserts the response has a header with the provided name and value

Then the response should have cookie "<cookieName>"

  • Asserts the response has a cookie with the provided name

Then the response should not have cookie "<cookieName>"

  • Asserts the response does not have a cookie with the provided name

Then the response cookie "<cookieName>" should be set to "<cookieValue>"

  • Asserts the response has a cookie with the provided name and value

Then the response cookie "<cookieName>" should have the "<attributeName>" attribute set

  • Asserts a cookie exists with the given name and has the given attribute set
  • The "attributeName" parameter can be "Secure" or "HTTPOnly"

Then the response cookie "<cookieName>" should not have the "<attributeName>" attribute set

  • Asserts a cookie exists with the given name but does not have the given attribute set
  • The "attributeName" parameter can be "Secure" or "HTTPOnly"
Clone this wiki locally