TC-AUTH-06
Security
Tampered token
Verify token integrity validation
Specification · xlsx
Steps
- Change one character in the token
- Call any API endpoint
Expected result
HTTP 401; access denied
Endpoints
POST /iam/api/v1/auth/tokenGET /order/api/v1/merchant-integration/outbound-orders/statuses Run
- API_URL
https://api.qa2.ananastest.com
A dry run builds every request without sending it; responses come from a local stub.
Test code
mirrors tests/TokenTest.php::tc_auth_06()
63// Verify token integrity validation
64public function tc_auth_06(): void
65{
66 $randomizer = new Randomizer;
67
68 $tokenData = $this->ananas->getToken();
69 $token = $tokenData['response']['access_token'];
70 $randomLetter = $randomizer->getBytesFromString('abcdefghijklmnopqrstuvwxyz', 1);
71 $token[0] = $randomLetter;
72
73 $this->ananas->setToken($token);
74 $response = $this->ananas->getOrderStatuses();
75
76 $this->assertEquals(401, $response['statusCode']);
77}
web/app/Scenarios/TokenScenarios.php · line numbers refer to this file
Not run yet. Run it against the API, or do a dry run to see the requests it would send.