Incomplete authentication test suite

I’m submitting a

• bug report.
• feature request.

Current Behaviour:

Authentication tests need to be updated. Current tests only test /+ API_NAME, rest everything needs to be tested as well.

Expected Behaviour:

Tests should check the authentication part thoroughly.

Steps to reproduce:

See hydrus/hydrus/tests/test_auth.py.

Do you want to work on this issue?

NO

[tibi77]

Maybe if we do not show the endpoints. We can create a specific file (for example http://localhost:8080/serverapi/endPoints) which can be password protected. I think that it will be safer.

Right now: If someone who is not authorized tries to login the server responds with:

{
  "message": "The User with ID <user_id> is not a valid/defined User"
} 

I have found this checklist[1]. Should i implement the checks that are there? Also the pentest part in [2] is interesting. PS: I am asking because i am not sure what behavior you are expecting.

[1] https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_content_types [2] https://www.owasp.org/index.php/REST_Assessment_Cheat_Sheet

[chirag-jn]

@xadahiya, if I am not wrong, the tests remain the same for all endpoints, it’s just that the URL inside self.client.get() changes?