Problem
Research questions and friction points this paper is trying to address.
REST API
HTTP semantics
fault detection
automated testing
Validating HTTP Semantics in REST APIs With Constructed Call Sequence Scenarios
🤖 AI Summary
This study addresses failures and usability issues in REST APIs caused by violations of HTTP semantic specifications. We extend the EvoMaster fuzzing tool by proposing an automated verification technique based on call sequence scenario construction and designing nine specialized test oracles to precisely detect semantic-level defects. Experimental results demonstrate that this approach successfully identifies all injected faults and discovers 166 previously unknown defects across 36 real-world APIs. These findings indicate a significant improvement in both the automation level and effectiveness of semantic compliance testing for REST APIs, offering a robust solution for ensuring adherence to HTTP standards in practice.
📝 Abstract
Context: REST APIs are widely used in industry. These APIs use HTTP for their communications. Failures in following the specifications of HTTP can lead to confusing and hard to use APIs, with possibly serious software faults with dire consequences. Objectives: Define novel automated techniques to automatically find HTTP semantics-level faults in existing REST APIs. Methods: We extended the state-of-the-art fuzzer EvoMaster with 9 new oracles to detect HTTP semanticslevel faults. Once the standard fuzzing process is finished generating N test cases, a new phase is executed in which these N tests are used as a starting point to create new scenarios (i.e., new sequences of HTTP calls) aimed at validating specific HTTP properties defined in these 9 oracles. Results: Experiments on 9 artificial APIs with inject faults show that our novel techniques can successfully detect all of them. Further experiments on 36 APIs from the WFD corpus show that our novel techniques can automatically find 166 existing faults in these real-world APIs. Conclusion: REST APIs use HTTP, and, as such, they need to follow its semantics to avoid misleading their clients and introducing subtle software faults. The novel techniques presented in this paper are shown to be effective at automatically finding several of this type of faults.
Innovation
Methods, ideas, or system contributions that make the work stand out.
REST API Testing
HTTP Semantics Validation
Fuzzing Oracles
Call Sequence Construction
EvoMaster
🔎 Similar Papers
No similar papers found.
