Security Testing

This guide covers how to test the security features implemented in the UBU Finance backend.

Overview

Security testing is crucial to ensure that the security measures implemented in the UBU Finance backend are working correctly. This guide provides instructions for testing various security features, including rate limiting, IP whitelisting, account lockout, and advanced logout.

Prerequisites

Before running security tests, ensure you have the following:

Python 3.8 or higher
Docker and Docker Compose (for monitoring tests)
Access to the UBU Finance backend codebase
Admin credentials for the UBU Finance backend

Automated Testing

The UBU Finance backend includes a script for automated security testing: setup_and_test.py. This script tests all security components and generates a report of the results.

Running the Automated Tests

To run the automated tests:

python setup_and_test.py

This will:

Start the Docker Compose services for monitoring (if not already running)
Test all security components
Generate a report of the results

Command-Line Options

The setup_and_test.py script accepts the following command-line options:

--skip-docker: Skip starting Docker Compose services
--test-only: Only run security tests (don't start Docker Compose services)

Example:

python setup_and_test.py --test-only

Test Report

The test report is saved to security_report.json and includes:

Timestamp of the test
Results of each security component test
Current security configuration

Manual Testing

In addition to the automated tests, you can manually test each security feature.

Rate Limiting

To test rate limiting:

Send multiple requests to an endpoint within a short time period
Verify that after exceeding the rate limit, subsequent requests are rejected with a 429 (Too Many Requests) status code

Example using curl:

# Send 100 requests to the health endpoint
for i in {1..100}; do
    curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8080/health
done

IP Whitelisting

To test IP whitelisting:

Enable IP whitelisting in the configuration
Add your IP address to the whitelist
Verify that you can access the API
Remove your IP address from the whitelist
Verify that you can no longer access the API

Example using the Security API:

# Add IP to whitelist
curl -X POST \
  -H "Authorization: Bearer $TOKEN" \
  http://localhost:8080/api/admin/security/whitelist/add/192.168.1.1

# Remove IP from whitelist
curl -X POST \
  -H "Authorization: Bearer $TOKEN" \
  http://localhost:8080/api/admin/security/whitelist/remove/192.168.1.1

Account Lockout

To test account lockout:

Attempt to log in with incorrect credentials multiple times
Verify that after exceeding the maximum number of failed attempts, the account is locked
Verify that you cannot log in with correct credentials while the account is locked
Wait for the lockout duration to expire or use the admin API to unlock the account
Verify that you can log in with correct credentials after the account is unlocked

Example using the authentication API:

# Attempt to log in with incorrect credentials
for i in {1..10}; do
    curl -X POST \
      -H "Content-Type: application/json" \
      -d '{"username":"testuser","password":"wrongpassword"}' \
      http://localhost:8080/authentication/request-otp
done

# Attempt to log in with correct credentials (should fail if account is locked)
curl -X POST \
  -H "Content-Type: application/json" \
  -d '{"username":"testuser","password":"correctpassword"}' \
  http://localhost:8080/authentication/request-otp

# Unlock account using admin API
curl -X POST \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  http://localhost:8080/api/admin/security/account/unlock/testuser

Advanced Logout

To test advanced logout:

Log in to obtain a token
Use the token to access a protected endpoint
Log out using the logout endpoint
Verify that the token is no longer valid
Log in again to obtain a new token
Use the new token to access a protected endpoint
Log out from all devices using the logout-all-devices endpoint
Verify that the token is no longer valid

Example using the authentication API:

# Log in
TOKEN=$(curl -X POST \
  -H "Content-Type: application/json" \
  -d '{"username":"testuser","password":"password"}' \
  http://localhost:8080/authentication/request-otp | jq -r '.access_token')

# Access protected endpoint
curl -H "Authorization: Bearer $TOKEN" \
  http://localhost:8080/api/protected-endpoint

# Log out
curl -X POST \
  -H "Authorization: Bearer $TOKEN" \
  http://localhost:8080/authentication/logout

# Attempt to access protected endpoint (should fail)
curl -H "Authorization: Bearer $TOKEN" \
  http://localhost:8080/api/protected-endpoint

# Log in again
TOKEN=$(curl -X POST \
  -H "Content-Type: application/json" \
  -d '{"username":"testuser","password":"password"}' \
  http://localhost:8080/authentication/request-otp | jq -r '.access_token')

# Log out from all devices
curl -X POST \
  -H "Authorization: Bearer $TOKEN" \
  http://localhost:8080/authentication/logout-all-devices

Monitoring Tests

To test the monitoring and alerting system:

Start the Docker Compose services:

docker-compose up -d

Access the Grafana dashboard at http://localhost:3000 (default credentials: admin/admin)
Verify that the UBU Finance overview dashboard is available
Verify that metrics are being collected
Trigger alerts by exceeding thresholds (e.g., generate errors, exceed rate limits)
Verify that alerts are triggered and notifications are sent

Security Configuration Testing

To test different security configurations:

Modify the environment variables or the app/config/security_config.py file
Restart the application
Verify that the new configuration is applied

Example environment variables:

# Rate Limiting
export RATE_LIMIT_ENABLED=true
export RATE_LIMIT_MAX_REQUESTS=10
export RATE_LIMIT_WINDOW_SECONDS=60

# IP Whitelist
export IP_WHITELIST_ENABLED=true
export IP_WHITELIST=127.0.0.1
export IP_WHITELIST_ALLOW_LOCALHOST=true

# Account Lockout
export ACCOUNT_LOCKOUT_ENABLED=true
export ACCOUNT_LOCKOUT_MAX_FAILED_ATTEMPTS=3
export ACCOUNT_LOCKOUT_DURATION_SECONDS=300

Performance Testing

To test the performance impact of security features:

Run performance tests with security features disabled
Run performance tests with security features enabled
Compare the results to ensure that security features don't significantly impact performance

Example using Apache Benchmark:

# Test with security features disabled
ab -n 1000 -c 10 http://localhost:8080/health

# Test with security features enabled
ab -n 1000 -c 10 http://localhost:8080/health

Security Audit

Periodically conduct a security audit to ensure that all security features are working correctly:

Review security logs for suspicious activity
Check for unauthorized access attempts
Verify that rate limiting is preventing abuse
Ensure that account lockout is protecting against brute force attacks
Confirm that IP whitelisting is restricting access as expected
Validate that advanced logout is properly invalidating tokens

Troubleshooting

If you encounter issues during security testing:

Check the application logs for error messages
Verify that the security configuration is correct
Ensure that Redis is running (if used for rate limiting and token blacklisting)
Check that the database is accessible (for account lockout and token versioning)
Verify that Docker services are running (for monitoring tests)

Best Practices

Regular Testing: Conduct security tests regularly to ensure that security features continue to work correctly.
Automated Testing: Automate security tests to make them part of your CI/CD pipeline.
Comprehensive Testing: Test all security features, not just the ones you think might fail.
Edge Cases: Test edge cases, such as rate limiting with concurrent requests or account lockout with simultaneous login attempts.
Documentation: Document all security tests and their results for future reference.
Penetration Testing: Periodically conduct penetration testing to identify vulnerabilities.
Security Updates: Keep all dependencies up to date to address security vulnerabilities.