Did You Remember to Test Your Tokens?
Danielle Gonzalez, Michael Rath, Mehdi Mirakhorli

TL;DR
This paper develops a comprehensive, developer-friendly guide of 53 unit test cases for token authentication in Spring Security, based on analysis of real-world Java tests, to improve security testing practices.
Contribution
It introduces a novel, empirically-derived catalog of unit test cases for token authentication, filling a gap in security testing resources for developers.
Findings
Identified 53 common test cases from 481 JUnit tests across 53 projects.
Provided a structured test guide with scenarios, conditions, and expected outcomes.
Gathered developer feedback confirming the guide's usefulness.
Abstract
Authentication is a critical security feature for confirming the identity of a system's users, typically implemented with help from frameworks like Spring Security. It is a complex feature which should be robustly tested at all stages of development. Unit testing is an effective technique for fine-grained verification of feature behaviors that is not widely-used to test authentication. Part of the problem is that resources to help developers unit test security features are limited. Most security testing guides recommend test cases in a "black box" or penetration testing perspective. These resources are not easily applicable to developers writing new unit tests, or who want a security-focused perspective on coverage. In this paper, we address these issues by applying a grounded theory-based approach to identify common (unit) test cases for token authentication through analysis of 481…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
