Authorization testing in Testing Fundamentals - Build an Automation Script

Verify user cannot access admin page without admin role

Preconditions (2)

Step 1: Navigate to the admin page URL (e.g., /admin/dashboard)

Step 2: Observe the page response

✅ Expected Result: User is denied access to the admin page and sees an error message or is redirected to an access denied page

Automation Requirements - Selenium with Python

Assertions Needed:

Verify the current URL is not the admin page URL

Verify the error message or access denied message is displayed

Best Practices:

Use explicit waits to wait for page elements

Use Page Object Model to separate page interactions

Use clear and maintainable locators (id, class, or accessible attributes)

Avoid hardcoded sleeps

Use assertions that clearly check the expected conditions

Automated Solution

Testing Fundamentals

from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
import unittest

class AdminPageAuthorizationTest(unittest.TestCase):
    def setUp(self):
        self.driver = webdriver.Chrome()
        self.driver.implicitly_wait(5)
        # Precondition: User is logged in as regular user
        self.login_as_regular_user()

    def login_as_regular_user(self):
        driver = self.driver
        driver.get('https://example.com/login')
        driver.find_element(By.ID, 'email').send_keys('[e-mail]')
        driver.find_element(By.ID, 'password').send_keys('UserPass123')
        driver.find_element(By.ID, 'login-button').click()
        # Wait until login completes by checking presence of logout button
        WebDriverWait(driver, 10).until(
            EC.presence_of_element_located((By.ID, 'logout-button'))
        )

    def test_access_admin_page_denied(self):
        driver = self.driver
        admin_url = 'https://example.com/admin/dashboard'
        driver.get(admin_url)

        # Wait for either error message or redirect
        error_message_locator = (By.ID, 'access-denied-message')
        try:
            error_element = WebDriverWait(driver, 10).until(
                EC.visibility_of_element_located(error_message_locator)
            )
            error_text = error_element.text
        except:
            error_text = ''

        # Assert current URL is not admin page URL
        self.assertNotEqual(driver.current_url, admin_url, 'User should not access admin page URL')

        # Assert error message is displayed
        self.assertTrue(error_text != '', 'Access denied message should be visible')

    def tearDown(self):
        self.driver.quit()

if __name__ == '__main__':
    unittest.main()

This test script uses Selenium with Python's unittest framework.

setUp() logs in a regular user before each test.

The test_access_admin_page_denied method navigates to the admin page URL.

It waits explicitly for an access denied message to appear or for a redirect.

Assertions check that the URL is not the admin page and that an error message is visible.

Locators use IDs for clarity and maintainability.

Explicit waits avoid timing issues.

tearDown closes the browser after the test.

Common Mistakes - 3 Pitfalls

Using hardcoded sleep instead of explicit waits

Using brittle XPath locators that break easily

Not verifying the URL or error message after navigation

Bonus Challenge

Now add data-driven testing with 3 different user roles: regular user, admin user, and guest user, verifying access accordingly.

Show Hint

Practice

1. What is the main goal of authorization testing in software applications?

easy

A. To find syntax errors in the code

B. To verify users can only access allowed resources

C. To test the speed of the application

D. To check if the software installs correctly

Solution

1. Step 1: Understand the purpose of authorization testing

   Authorization testing checks if users have permission to access certain parts of the system.

2. Step 2: Differentiate from other testing types

   Unlike installation or speed tests, authorization focuses on access control.

3. Final Answer:

   To verify users can only access allowed resources -> Option B

4. Quick Check:

   Authorization = Access control [OK]

Hint: Authorization means checking user access rights [OK]

Common Mistakes:

• Confusing authorization with authentication
• Thinking it tests software installation
• Mixing it with performance testing

2. Which of the following is the correct way to test if a user with role guest cannot access the admin page?

easy

A. Assert that accessing admin page returns status code 403

B. Assert that accessing admin page returns status code 200

C. Assert that the page loads without any error

D. Assert that the user can edit admin settings

Solution

1. Step 1: Identify expected behavior for unauthorized access

   A guest user should be denied access, usually indicated by HTTP status 403 (Forbidden).

2. Step 2: Match assertion with expected status code

   Checking for status 403 confirms access is blocked correctly.

3. Final Answer:

   Assert that accessing admin page returns status code 403 -> Option A

4. Quick Check:

   Unauthorized access = status 403 [OK]

Hint: 403 means forbidden access, use it to test denial [OK]

Common Mistakes:

• Using status 200 which means success
• Ignoring error codes and only checking page load
• Testing edit rights for guest users

3. Consider this test code snippet for authorization:

def test_access(user_role):
    if user_role == 'admin':
        return 'Access granted'
    else:
        return 'Access denied'

result = test_access('guest')

What is the value of result after running this code?

medium

A. 'Access denied'

B. 'Access granted'

C. None

D. Error

Solution

1. Step 1: Analyze the function logic for 'guest' role

   The function returns 'Access granted' only if user_role is 'admin'. For 'guest', it returns 'Access denied'.

2. Step 2: Check the returned value for 'guest'

   Since 'guest' is not 'admin', the else branch runs, returning 'Access denied'.

3. Final Answer:

   'Access denied' -> Option A

4. Quick Check:

   Guest role = Access denied [OK]

Hint: Only admin gets access; others denied [OK]

Common Mistakes:

• Assuming guest has access
• Confusing return values
• Expecting None or error instead of string

4. You wrote this test to check if a user with role editor can access the edit page:

def test_editor_access():
    response = access_page('edit', 'editor')
    assert response.status_code == 200
    assert response.content == 'Access denied'

What is wrong with this test?

medium

A. It uses wrong role name 'editor'

B. It should assert status code 404 instead

C. It misses checking the response headers

D. It asserts success status but expects denial content

Solution

1. Step 1: Understand assertion conflict

   The test expects status code 200 (success) but also expects content 'Access denied', which is contradictory.

2. Step 2: Identify correct assertion logic

   If access is denied, status code should not be 200; usually 403 or similar. The test mixes success code with denial message.

3. Final Answer:

   It asserts success status but expects denial content -> Option D

4. Quick Check:

   Status 200 means success, can't deny access [OK]

Hint: Status and content must match access result [OK]

Common Mistakes:

• Mixing success status with denial message
• Ignoring role correctness
• Assuming 404 for access denial

5. You have three user roles: admin, editor, and viewer. The editor can edit content but cannot access user management. Which test case best verifies this authorization rule?

hard

A. Test that viewer can edit content

B. Test that editor gets 200 on user management page

C. Test that editor can access edit page and gets 403 on user management page

D. Test that admin cannot access edit page

Solution

1. Step 1: Identify editor permissions

   Editor role should have access to edit content but be denied access to user management.

2. Step 2: Match test case to permissions

   Testing editor access to edit page (expect success) and user management page (expect 403 forbidden) verifies the rule correctly.

3. Final Answer:

   Test that editor can access edit page and gets 403 on user management page -> Option C

4. Quick Check:

   Editor edits allowed, user mgmt denied [OK]

Hint: Test allowed and denied pages per role [OK]

Common Mistakes:

• Testing wrong permissions for roles
• Expecting viewer to edit content
• Assuming admin cannot edit content