Online Testing of RESTful APIs: Promises and ChallengesDistinguished Paper Award
Online testing of web APIs—testing APIs in production—is gaining traction in industry. Platforms such as RapidAPI and Sauce Labs provide online testing and monitoring services of web APIs 24/7, typically by re-executing manually designed test cases on the target APIs on a regular basis. In parallel, research on the automated generation of test cases for RESTful APIs has seen significant advances in recent years. However, despite their promising results in the lab, it is unclear whether research tools would scale to industrial-size settings and, more importantly, how they would perform in an online testing setup, increasingly common in practice. In this paper, we report the results of an empirical study on the use of automated test case generation methods for online testing of RESTful APIs. Specifically, we used the RESTest framework to automatically generate and execute test cases in 13 industrial APIs for 15 days non-stop, resulting in over one million test cases. To scale at this level, we had to transition from a monolithic tool approach to a multi-bot architecture with over 200 bots working cooperatively in tasks like test generation and reporting. As a result, we uncovered about 390K failures, which we conservatively triaged into 254 bugs, 65 of which have been acknowledged or fixed by developers to date. Among others, we identified confirmed faults in the APIs of Amadeus, Foursquare, Yelp, and YouTube, accessed by millions of applications worldwide. More importantly, our reports have guided developers on improving their APIs, including bug fixes and documentation updates in the APIs of Amadeus and YouTube. Our results show the potential of online testing of RESTful APIs as the next must-have feature in industry, but also some of the key challenges to overcome for its full adoption in practice.
Tue 15 NovDisplayed time zone: Beijing, Chongqing, Hong Kong, Urumqi change
10:45 - 12:15 | Software Testing IIResearch Papers / Demonstrations at SRC LT 50 Chair(s): Baishakhi Ray Columbia University | ||
10:45 15mTalk | Online Testing of RESTful APIs: Promises and ChallengesDistinguished Paper Award Research Papers Alberto Martin-Lopez University of Seville, Sergio Segura University of Seville, Antonio Ruiz-Cortés University of Seville DOI Pre-print | ||
11:00 15mTalk | Avgust: Automating Usage-Based Test Generation from Videos of App Executions Research Papers Yixue Zhao University of Massachusetts at Amherst, Saghar Talebipour University of Southern California, Kesina Baral George Mason University, Hyojae Park Sharon High School, Leon Yee Valley Christian High School, Safwat Ali Khan George Mason University, Yuriy Brun University of Massachusetts, Nenad Medvidović University of Southern California, Kevin Moran George Mason University DOI Pre-print Media Attached | ||
11:15 15mTalk | RoboFuzz: Fuzzing Robotic Systems over Robot Operating System (ROS) for Finding Correctness Bugs Research Papers DOI | ||
11:30 7mTalk | CLIFuzzer: Mining Grammars for Command-Line Invocations Demonstrations Abhilash Gupta CISPA Helmholtz Center for Information Security, Rahul Gopinath University of Sydney, Andreas Zeller CISPA Helmholtz Center for Information Security Link to publication DOI Pre-print Media Attached | ||
11:38 7mTalk | RecipeGen++: An Automated Trigger Action Programs Generator Demonstrations Imam Nur Bani Yusuf Singapore Management University, Singapore, Diyanah Binte Abdul Jamal Singapore Management University, Lingxiao Jiang Singapore Management University, David Lo Singapore Management University |