Authorization testing in Testing Fundamentals - Full Explanation

Introduction

Imagine you have a building with many rooms, but only certain people can enter specific rooms. Authorization testing solves the problem of making sure that only the right people can access the right parts of a system or application.

Explanation

Purpose of Authorization Testing

Authorization testing checks if users can only perform actions or access data they are allowed to. It ensures that permissions and roles are correctly enforced to protect sensitive information and functions.

Authorization testing confirms that access controls work as intended to prevent unauthorized actions.

Difference Between Authentication and Authorization

Authentication verifies who a user is, like checking an ID card. Authorization decides what that user can do or see after identity is confirmed. Testing focuses on the second part to ensure proper access rights.

Authorization testing focuses on permissions after identity is confirmed by authentication.

Common Authorization Testing Methods

Testers try to access restricted areas or perform actions without proper rights. This includes role-based testing, permission boundary testing, and negative testing where unauthorized access attempts are made.

Testing methods simulate both allowed and disallowed access to verify controls.

Importance of Role-Based Access Control (RBAC)

RBAC assigns permissions based on user roles, simplifying management. Authorization testing checks that each role only has the permissions it should, preventing privilege escalation or leaks.

RBAC testing ensures roles have correct and limited permissions.

Testing for Privilege Escalation

This involves checking if a user can gain higher access rights than assigned, either by manipulating requests or exploiting flaws. Preventing this is critical for system security.

Authorization testing must detect and block attempts to increase privileges improperly.

Real World Analogy

Think of a hotel where guests have key cards that open only their rooms and some common areas. Authorization testing is like checking that guests cannot open other guests' rooms or restricted staff areas.

Purpose of Authorization Testing → Ensuring guests can only enter their own rooms and allowed areas.

Difference Between Authentication and Authorization → Checking guest identity at reception (authentication) versus what rooms their key card opens (authorization).

Common Authorization Testing Methods → Trying to use a guest key card to open other rooms or staff-only doors.

Importance of Role-Based Access Control (RBAC) → Different key cards for guests, housekeeping, and managers with specific access.

Testing for Privilege Escalation → Making sure a guest cannot use tricks to get a master key card.

Diagram

Diagram

┌───────────────────────────────┐
│          User Login            │
└──────────────┬────────────────┘
               │ Authentication
               ↓
      ┌─────────────────────┐
      │ Authorization Check │
      └─────────┬───────────┘
                │
   ┌────────────┴─────────────┐
   │                          │
Allowed Access           Denied Access
   │                          │
   ↓                          ↓
Access granted          Access blocked

Diagram showing the flow from user login through authentication to authorization deciding access.

Key Facts

Authorization → The process of determining what actions or resources a user is allowed to access.

Authentication → The process of verifying a user's identity before authorization.

Role-Based Access Control (RBAC) → A method of assigning permissions to users based on their roles.

Privilege Escalation → An unauthorized increase in access rights or permissions.

Negative Testing → Testing that ensures the system properly denies unauthorized access.

Code Example

Testing Fundamentals

import unittest

class AuthorizationTest(unittest.TestCase):
    def setUp(self):
        # Simulate user roles and permissions
        self.permissions = {
            'admin': ['read', 'write', 'delete'],
            'user': ['read'],
            'guest': []
        }

    def can_access(self, role, action):
        return action in self.permissions.get(role, [])

    def test_admin_access(self):
        self.assertTrue(self.can_access('admin', 'delete'))

    def test_user_no_delete(self):
        self.assertFalse(self.can_access('user', 'delete'))

    def test_guest_no_read(self):
        self.assertFalse(self.can_access('guest', 'read'))

if __name__ == '__main__':
    unittest.main()

Common Confusions

Authorization testing is the same as authentication testing.

Authorization testing is the same as authentication testing. Authentication confirms who the user is, while authorization checks what the user can do; they are separate processes.

If a user is authenticated, they automatically have full access.

If a user is authenticated, they automatically have full access. Authentication only verifies identity; authorization controls access rights and can restrict actions even for authenticated users.

Summary

Authorization testing ensures users can only access what they are allowed to, protecting sensitive parts of a system.

It is different from authentication, which only verifies user identity before access rights are checked.

Testing includes checking role permissions, preventing unauthorized access, and stopping privilege escalation.

Practice

1. What is the main goal of authorization testing in software applications?

easy

A. To find syntax errors in the code

B. To verify users can only access allowed resources

C. To test the speed of the application

D. To check if the software installs correctly

Solution

1. Step 1: Understand the purpose of authorization testing

   Authorization testing checks if users have permission to access certain parts of the system.

2. Step 2: Differentiate from other testing types

   Unlike installation or speed tests, authorization focuses on access control.

3. Final Answer:

   To verify users can only access allowed resources -> Option B

4. Quick Check:

   Authorization = Access control [OK]

Hint: Authorization means checking user access rights [OK]

Common Mistakes:

• Confusing authorization with authentication
• Thinking it tests software installation
• Mixing it with performance testing

2. Which of the following is the correct way to test if a user with role guest cannot access the admin page?

easy

A. Assert that accessing admin page returns status code 403

B. Assert that accessing admin page returns status code 200

C. Assert that the page loads without any error

D. Assert that the user can edit admin settings

Solution

1. Step 1: Identify expected behavior for unauthorized access

   A guest user should be denied access, usually indicated by HTTP status 403 (Forbidden).

2. Step 2: Match assertion with expected status code

   Checking for status 403 confirms access is blocked correctly.

3. Final Answer:

   Assert that accessing admin page returns status code 403 -> Option A

4. Quick Check:

   Unauthorized access = status 403 [OK]

Hint: 403 means forbidden access, use it to test denial [OK]

Common Mistakes:

• Using status 200 which means success
• Ignoring error codes and only checking page load
• Testing edit rights for guest users

3. Consider this test code snippet for authorization:

def test_access(user_role):
    if user_role == 'admin':
        return 'Access granted'
    else:
        return 'Access denied'

result = test_access('guest')

What is the value of result after running this code?

medium

A. 'Access denied'

B. 'Access granted'

C. None

D. Error

Solution

1. Step 1: Analyze the function logic for 'guest' role

   The function returns 'Access granted' only if user_role is 'admin'. For 'guest', it returns 'Access denied'.

2. Step 2: Check the returned value for 'guest'

   Since 'guest' is not 'admin', the else branch runs, returning 'Access denied'.

3. Final Answer:

   'Access denied' -> Option A

4. Quick Check:

   Guest role = Access denied [OK]

Hint: Only admin gets access; others denied [OK]

Common Mistakes:

• Assuming guest has access
• Confusing return values
• Expecting None or error instead of string

4. You wrote this test to check if a user with role editor can access the edit page:

def test_editor_access():
    response = access_page('edit', 'editor')
    assert response.status_code == 200
    assert response.content == 'Access denied'

What is wrong with this test?

medium

A. It uses wrong role name 'editor'

B. It should assert status code 404 instead

C. It misses checking the response headers

D. It asserts success status but expects denial content

Solution

1. Step 1: Understand assertion conflict

   The test expects status code 200 (success) but also expects content 'Access denied', which is contradictory.

2. Step 2: Identify correct assertion logic

   If access is denied, status code should not be 200; usually 403 or similar. The test mixes success code with denial message.

3. Final Answer:

   It asserts success status but expects denial content -> Option D

4. Quick Check:

   Status 200 means success, can't deny access [OK]

Hint: Status and content must match access result [OK]

Common Mistakes:

• Mixing success status with denial message
• Ignoring role correctness
• Assuming 404 for access denial

5. You have three user roles: admin, editor, and viewer. The editor can edit content but cannot access user management. Which test case best verifies this authorization rule?

hard

A. Test that viewer can edit content

B. Test that editor gets 200 on user management page

C. Test that editor can access edit page and gets 403 on user management page

D. Test that admin cannot access edit page

Solution

1. Step 1: Identify editor permissions

   Editor role should have access to edit content but be denied access to user management.

2. Step 2: Match test case to permissions

   Testing editor access to edit page (expect success) and user management page (expect 403 forbidden) verifies the rule correctly.

3. Final Answer:

   Test that editor can access edit page and gets 403 on user management page -> Option C

4. Quick Check:

   Editor edits allowed, user mgmt denied [OK]

Hint: Test allowed and denied pages per role [OK]

Common Mistakes:

• Testing wrong permissions for roles
• Expecting viewer to edit content
• Assuming admin cannot edit content