Add tutorial submission (Schemathesis)

[RafDevX]

Assignment Proposal

Title

REST API Fuzzing using Schemathesis

Names and KTH ID

• Rafael Oliveira ([email protected])
• Sofia Edvardsson ([email protected])

Deadline

• Task 3

Category

• Executable tutorial

Description

As software solutions increasingly turn to web-based stacks, it becomes paramount to include comprehensive API testing within CI pipeline processes. We believe that performing automated testing of API endpoints, in a continuous
fashion, is of great benefit to any project used by consuming clients and so it is very relevant for (aspiring) developers to get a sense of how one might do that in a systematic fashion.

Thus, we propose creating an executable tutorial that can pedagogically introduce developers unacquainted with these techniques to a specific workflow that they might use later in their professional lives. In particular, we wish to introduce learners to the Schemathesis tool, which allows for automated fuzzing of REST APIs based on an OpenAPI contract document.

We will include a simple sample project with non-obvious logic errors, guide the user to run Schemathesis and explore the potential vulnerabilities it detects, as well as show them how to use the information reported to easily fix or mitigate the problems in question.

Relevance

Automated fuzzing, especially in this particular context of REST APIs, is at the heart of automated testing, which we have discussed in week 2 of this course and is essential to allow for effective Continuous Integration without compromising robustness. Our proposed tutorial hopes to demonstrate how to use a tool like Schemathesis as a key component in a testing pipeline to complement human-written and human-driven tests to ensure all stakeholders have confidence in the system's continuous reliability.

Submission

Our tutorial is available here, with the corresponding source code in this repository.

[RafDevX]

Please merge this only after #2632 (the assignment proposal). We realize that this task was technically not approved before this submission, but we wanted to meet the deadline we committed ourselves to, and we waited to the last possible minute for the proposal to be reviewed (we submitted it last Wednesday). We hope you understand 🙂

[Stranger6667]

Folks, that’s is fascinating! Would you mind if I’ll add a link to this tutorial to the Schemathesis repo?

also, feel free to ping me in case if something could be improved on the Schemathesis side

[RafDevX]

Hi @Stranger6667, no idea how you came across this, but we're glad you think it's interesting!

Yes, you're very welcome to link the tutorial if you believe it'll help people get started with Schemathesis. We tried out several tools and yours seemed to be the easiest to use and the one that yielded the best results, that's why we went with it. Congratulations on a great project well achieved!

[Stranger6667]

@RafDevX Thank you for your kind words!

Please, don't hesitate to reach out in case of any feedback you have! :) Or if there is a place to read feedback on the tutorial (i.e. from students), I am eager to check it out and improve Schemathesis :)

[algomaster99]

Awesome tutorial! I also liked the easter egg 🥄