Клієнт-серверна архітектура: що потрібно знати тестувальнику | HTTP, HTTPS, JWT, Cache, Cookies

In this video, we analyze client-server architecture from the perspective of a QA Engineer. Timecodes: 0:00 Introduction - why QA needs to know architecture 0:47 Architecture layers - thick and thin client 1:44 HTTP - a protocol that a tester needs to know 2:57 HTTPS - why S matters for testing 4:12 Cache & Cookies - the invisible part of testing 5:48 Authentication, authorization, identification 7:21 Practice - DevTools for QA 8:23 Typical bugs and a tester's checklist 9:29 Conclusion and what to learn next #qa #testing #manualqa #automationqa #apitesting #http #https #jwt #devtools #softwaretesting #qajunior #allaboutqa CHECKLIST - HTTP/API: Server returns 200 even on error - check the response body No valid status 404 - returns 200 with an empty body POST request is not idempotent - two clicks create two records No validation of input data on the server API does not limit the request size CHECKLIST — HTTPS: Expired certificate in test or production environment Mixed content — HTTP resource on HTTPS page HTTP does not redirect to HTTPS (or redirect with 302 instead of 301) SSL check is disabled in autotests and got into CI/CD CHECKLIST — CACHE: After updating the content, CDN distributes old data Cached autotest result distorts the next launch Browser cache hides the real state of the page CHECKLIST — AUTHENTICATION: Session is not deleted after logout (old cookie is still valid) IDOR — no verification of the resource owner at the server level JWT is not verified or signature is not validated on the backend Token is not invalidated after password change or logout HttpOnly and Secure attributes are missing on session cookies