Summary

In this chapter, we learned a few approaches and techniques that you can use to do security testing in Postman. This kind of testing is not a replacement for the work of professional security testers, but it should help you find some basic issues. We learned about some of the most common security risks and mistakes in APIs, and we discussed how to set up tests in Postman that will help you find these issues. We used the OWASP top 10 list as a guide to what kind of issues to look for.

We discussed fuzz testing as a technique that you can use to introduce randomness to your testing. This randomness can help you find issues that you might otherwise never have thought about. We learned about the big list of naughty strings and how to set up a Postman collection that can use that list to check if your API has poor behavior, in response to any of those nasty strings. Since the point of fuzz testing is to try many random things, we also went over how to clean up a system after...