How do you set up “test mode” for your Java app?

Question

I am working on a Java web app with unit tests that deploy the app in Jetty. I use HtmlUnit to hit the app and do some high level tests. I set it up so that I can use a singleton probe to modify my system configuration and add a "test" flag--This is handy because I want to be able to run some tests without having to authenticate an actual user or check user roles.

However, it seems like it could open the door for vulnerability when the app is deployed. I'm looking for suggestions about how to make this "back door" a little more bullet proof. I could use a mock object to handle this, but I think that still leaves the back door exposed.

Answer 1

Use special parameter that is long enough to assume. For example GUID. It could be even hard-coded in your application. All tests will append this parameter to each URL they are using. You can check this parameter using special HttpFilter and turn the test mode on.

Answer 2

Throw some kind of security around the process you use to change the app over to Test mode - Basic Authentication for that page, or something. This can all be configured directly in web.xml.

Answer 3

I have user accounts specifically for testing in all of my environments. I create them using the real registration process, nothing hand-made.

This bypasses your issue, allows me to test the signin process, and if needed I create multiple users with different traits/roles which I can test against.

Because the users are under my control, they remain consistent and match the expected test results.