backend-endpoint-security-test

Create two users with factory_boy factories, authenticate as user A with DRF's APIClient, then request user B's object by ID. Assert the response is 403 or 404 rather than 200, proving object-level permissions block cross-user access.

Parametrize a list of (method, URL) endpoint pairs and assert each returns 401 without credentials, with an expired token, and with a malformed JWT. Use APIClient.credentials with HTTP_AUTHORIZATION headers instead of force_authenticate for real auth checks.

Yes, force_authenticate sets the user directly without any JWT validation, so it is suitable only for authorization tests. For authentication tests, pass real or invalid tokens via the Authorization header to exercise the actual token verification path.

Send a deeply nested query (10+ levels) to the GraphQL endpoint and check whether the response contains errors or is rejected. If a 200 response returns full data, no depth limiting is configured, which is a denial-of-service finding.

Autouse fixtures like otp_common_patches mock django-ratelimit's is_ratelimited to always return False, so 429 responses never occur. Rate limiting tests must exclude or override these fixtures to exercise the real throttling logic.

Generated tests rely on discovered URL patterns and cannot infer business-logic authorization rules, so permission classes must be verified per app. Findings like missing rate limits are reported as warnings and still require manual triage.