Modeling behavioral RESTful web service interfaces in UML

Porres, Iván; Rauf, Irum

doi:10.1145/1982185.1982521

Cited by 21 publications

(7 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Pontes Pinheiro et al [49] presented a model-based testing approach to automatically generate test cases for RESTful Web services. In their approach, the user needs to define a behavioural model of the RESTful Web service under test, specified with a protocol state machine model in terms of preconditions and postconditions [50], [51]. The major drawback of this approach is that the generated test cases are based on the scenario defined and modelled manually by the user.…”

Section: Testing Web Servicesmentioning

confidence: 99%

Metamorphic Testing of RESTful Web APIs

Segura

Parejo

Troya

et al. 2018

IIEEE Trans. Software Eng.

View full text Add to dashboard Cite

Web Application Programming Interfaces (APIs) allow systems to interact with each other over the network. Modern Web APIs often adhere to the REST architectural style, being referred to as RESTful Web APIs. RESTful Web APIs are decomposed into multiple resources (e.g., a video in the YouTube API) that clients can manipulate through HTTP interactions. Testing Web APIs is critical but challenging due to the difficulty to assess the correctness of API responses, i.e., the oracle problem. Metamorphic testing alleviates the oracle problem by exploiting relations (so-called metamorphic relations) among multiple executions of the program under test. In this paper, we present a metamorphic testing approach for the detection of faults in RESTful Web APIs. We first propose six abstract relations that capture the shape of many of the metamorphic relations found in RESTful Web APIs, we call these Metamorphic Relation Output Patterns (MROPs). Each MROP can then be instantiated into one or more concrete metamorphic relations. The approach was evaluated using both automatically seeded and real faults in six subject Web APIs. Among other results, we identified 60 metamorphic relations (instances of the proposed MROPs) in the Web APIs of Spotify and YouTube. Each metamorphic relation was implemented using both random and manual test data, running over 4.7K automated tests. As a result, 11 issues were detected (3 in Spotify and 8 in YouTube), 10 of them confirmed by the API developers or reproduced by other users, supporting the effectiveness of the approach.

show abstract

Section: Testing Web Servicesmentioning

confidence: 99%

Metamorphic Testing of RESTful Web APIs

Segura

Parejo

Troya

et al. 2018

IIEEE Trans. Software Eng.

View full text Add to dashboard Cite

show abstract

“…We decided to omit the support for legacy systems in favor of straightforward creation of complete and deployable REST APIs, which should allow to replace any legacy system in the future. In the first iteration of this project the focus is on structural mod-els with the intention to extend it with a behavioral model similar to the work of (Porres and Rauf, 2011).…”

Section: Related Workmentioning

confidence: 99%

Model-driven Development of RESTful APIs

Schreibmann

Braun

2015

Proceedings of the 11th International Conference on Web Information Systems and Technologies

View full text Add to dashboard Cite

We propose a model-driven approach for creating RESTful APIs. Today, REST APIs are developed by using frameworks and libraries that support software developers on the level of the chosen programming language, i.e., a lower level of abstraction. We argue that the development process can benefit from a model-driven approach, where an API is modeled on a higher level of abstraction by using a new formal language that was designed in particular for this application domain. From this model, the source code of the API is generated automatically, along with necessary code on the business logic and database layer. The benefits of this approach include higher productivity, better maintenance, higher quality, and documentation for free.

show abstract

“…We adopt a model-driven approach -Security and Rest compliant UML Models (SecReUM) -that builds on the theory presented in [22] to create a security-validating wrapper. We define the structural interface of a REST API using UML class diagram.…”

Section: Introductionmentioning

confidence: 99%

Securing Open Source Clouds Using Models

Rauf

Troubitsynå

2018

Electron. Proc. Theor. Comput. Sci.

Self Cite

View full text Add to dashboard Cite

The widespread adoption of cloud computing has resulted in proliferation of open source cloud computing frameworks that give more control to enterprises over their data and networks. Though, the benefits of the open source software are widely recognized, there is a growing concern over their security assurance. Often open source software is a subject of frequent updates. The updates might introduce or remove a variety of features and hence violate security properties of the previous releases. Obviously, a manual inspection of security would be prohibitively slow and inefficient. In this work, we propose an automated approach that can help developers to assure security of open source cloud framework even in the presence of frequent releases. Our methodology consists of creating a (stateful) wrapper that emulates the usage scenarios with explicit representation of security and functional requirements as contracts. We use a model-driven approach to model REST APIs of KeyStone, an identity service in OpenStack. Openstack is an open source cloud computing framework providing IaaS. Our models define structural and behavioral properties of Keystone together with its security requirements. We detail the implementation of these models in Django Web Framework and also show how to use the behavioral interfaces to implement a service monitor for the cloud services. This mechanism facilitates verification and validation of functional behavior and security requirement in an automated manner. Keystone Open StackKeystone is the centralized identity service of OpenStack that offers authentication and authorization [25]. KeyStone authenticates a user by generating a token. A token can either be scoped or unscoped depending on the client's request and the configured policy of KeyStone. An unscoped token authenticates a user without authorising for any project. In contrast, a scoped token provides the authorization information of the user for a particular project or domain.KeyStone offers REST API in compliance with OpenStack policy [3]. REST services expose their functionality as resources and each resource has a unique URI that provides addressability. CRUD (create, retrieve, update and delete) operations can be performed on resources using standard HTTP methods. This means that only HTTP request methods (GET, PUT, POST, DELETE) can be invoked on KeyStone resources. In order to offer scalability, the statelessness feature of REST is ensured by treating every request independently without requiring any session or cookie information from user requests. Each resource, when invoked via its URI and a standard HTTP method, replies with a status code and a resource representation, which contains the data about the resource attributes and links to other resources. The HTTP response code is a numeric code that tells the clients whether the request went successfully. HTTP has a list of status codes that reveal how the request went [7], for example, 200 means the request was successful, 404 means the resource was not found and 403 implies th...

show abstract

Modeling behavioral RESTful web service interfaces in UML

Cited by 21 publications

References 16 publications

Metamorphic Testing of RESTful Web APIs

Metamorphic Testing of RESTful Web APIs

Model-driven Development of RESTful APIs

Securing Open Source Clouds Using Models

Contact Info

Product

Resources

About