TC-AUTH-05 Negative Security

Token expiration

Verify system behavior when an expired token is used

! Documented discrepancy · errors.txt

Obtaining a token and waiting for it to expire is unfeasible in the automated testing environment. A preobtained expired token is used instead to simulate the test.

Specification · xlsx

Steps

Obtain a token
Wait for it to expire
Call another endpoint with the expired token

Expected result

HTTP 401 Unauthorized; access denied

Endpoints

POST /iam/api/v1/auth/tokenGET /order/api/v1/merchant-integration/outbound-orders/statuses

Run

API_URL: https://api.qa2.ananastest.com
EXPIRED_TOKEN: eyJraWQiOiJFcHF4UVpUY3hr…twUGPMAA

Change parameters

A dry run builds every request without sending it; responses come from a local stub.

Test code

mirrors tests/TokenTest.php::tc_auth_05()

54// Verify system behavior when an expired token is used

55public function tc_auth_05(): void

56{

57 $this->ananas->setToken($_ENV['EXPIRED_TOKEN']);

58 $response = $this->ananas->getOrderStatuses();

✗60 $this->assertEquals(401, $response['statusCode']);

61}

web/app/Scenarios/TokenScenarios.php · line numbers refer to this file

Assertions

	Line	Assertion	Expected	Actual
✗	60	`assertEquals`	`401`	`504`

The run stopped at the first failed assertion, as PHPUnit does.

HTTP exchanges 1

1 GET /order/api/v1/merchant-integration/outbound-orders/statuses 504 Gateway Time-out 10.23 s

Request

GET https://api.qa2.ananastest.com/order/api/v1/merchant-integration/outbound-orders/statuses

User-Agent: GuzzleHttp/7
Host: api.qa2.ananastest.com
Authorization: Bearer eyJraWQiOiJFcHF4UVpUY3hrSklmd0lRQWd1MU5JNzZkUzNjemZDSUFEYWZ2Q1Z2T3E4PSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiIxcjk3aWdnM2hzZjd1N21sdHBkYmwyMWowbCIsInRva2VuX3VzZSI6ImFjY2VzcyIsInNjb3BlIjoicHVibGljX2FwaS9mdWxsX2FjY2VzcyIsImF1dGhfdGltZSI6MTc4ODU2NjQwNywiaXNzIjoiaHR0cHM6Ly9jb2duaXRvLWlkcC5ldS1jZW50cmFsLTEuYW1hem9uYXdzLmNvbS9ldS1jZW50cmFsLTFfbjV1QW15cDVrIiwiZXhwIjoxNzg4NjUyODA3LCJpYXQiOjE3ODg1NjY0MDcsInZlcnNpb24iOjIsImp0aSI6Ijc5ZTlhMGIxLTI0NTUtNGQ5OS05OTY0LWQ0MzkxZWU0ZTU4YyIsImNsaWVudF9pZCI6IjFyOTdpZ2czaHNmN3U3bWx0cGRibDIxajBsIn0.dYKQD3rgHw2_LpaUt_EUuHf9lE4KE8f2_fPpOKIQpltzo7P3smQqRE7UzVWsPgSbnZ94jzbOZb13tximgPx9ZNt5WrZkEBdedzwMszBLOTKXSwhsVm1pVpbUsoiBKpBY-gPbyMi2JpMrSwsvd8qOva3tFevF8NTojLV1eAgwOAb42U0sIk12TdgEqAHhQb4Qaq_XWbVo78SZulUQHPM5WvBQJcZmKHee-tTvk2xi-7AJ8sRDiDiZrTtnIXDdXU7IPp6nKAyCRVJEEO1ZGvF_-J_HXfz9ZtZugjheXu1WMZT8Yer1nb1mlAxNCcsM65qNwu8B9DVDJrAgg0twUGPMAA

No body

Response

504 Gateway Time-out 10.23 s

Server: awselb/2.0
Date: Wed, 11 Nov 2026 13:15:07 GMT
Content-Type: text/html
Content-Length: 132
Connection: keep-alive

Text · 132 B

<html>
<head><title>504 Gateway Time-out</title></head>
<body>
<center><h1>504 Gateway Time-out</h1></center>
</body>
</html>

cURL

curl -X GET 'https://api.qa2.ananastest.com/order/api/v1/merchant-integration/outbound-orders/statuses' \
  -H 'Authorization: Bearer eyJraWQiOiJFcHF4UVpUY3hrSklmd0lRQWd1MU5JNzZkUzNjemZDSUFEYWZ2Q1Z2T3E4PSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiIxcjk3aWdnM2hzZjd1N21sdHBkYmwyMWowbCIsInRva2VuX3VzZSI6ImFjY2VzcyIsInNjb3BlIjoicHVibGljX2FwaS9mdWxsX2FjY2VzcyIsImF1dGhfdGltZSI6MTc4ODU2NjQwNywiaXNzIjoiaHR0cHM6Ly9jb2duaXRvLWlkcC5ldS1jZW50cmFsLTEuYW1hem9uYXdzLmNvbS9ldS1jZW50cmFsLTFfbjV1QW15cDVrIiwiZXhwIjoxNzg4NjUyODA3LCJpYXQiOjE3ODg1NjY0MDcsInZlcnNpb24iOjIsImp0aSI6Ijc5ZTlhMGIxLTI0NTUtNGQ5OS05OTY0LWQ0MzkxZWU0ZTU4YyIsImNsaWVudF9pZCI6IjFyOTdpZ2czaHNmN3U3bWx0cGRibDIxajBsIn0.dYKQD3rgHw2_LpaUt_EUuHf9lE4KE8f2_fPpOKIQpltzo7P3smQqRE7UzVWsPgSbnZ94jzbOZb13tximgPx9ZNt5WrZkEBdedzwMszBLOTKXSwhsVm1pVpbUsoiBKpBY-gPbyMi2JpMrSwsvd8qOva3tFevF8NTojLV1eAgwOAb42U0sIk12TdgEqAHhQb4Qaq_XWbVo78SZulUQHPM5WvBQJcZmKHee-tTvk2xi-7AJ8sRDiDiZrTtnIXDdXU7IPp6nKAyCRVJEEO1ZGvF_-J_HXfz9ZtZugjheXu1WMZT8Yer1nb1mlAxNCcsM65qNwu8B9DVDJrAgg0twUGPMAA'