Loading published curriculum…

18 · Testing the complete backend / LESSON 90 OF 102

MockMvc, JSON contracts, and security tests

HTTP tests must exercise routing, conversion, validation, and the relevant filters together.

Before this lesson: Mockito, fakes, and dependency boundaries

Understand the topic

MockMvc can run servlet request processing without a real network port. A narrow MVC slice is useful for controller contracts, while a full application test verifies broader wiring. Load the intended security configuration and avoid disabling filters merely to make tests pass.

Use authenticated test users and CSRF support appropriate to the application. Test anonymous, authorized, and wrong-owner cases. Assert response body and persisted side effects; a status-only test can miss a write that incorrectly happened before rejection.

EXAMPLE · JAVA

MockMvc assertion fragment

mockMvc.perform(post("/api/tasks")
 .with(user("learner").roles("USER"))
 .with(csrf())
 .contentType("application/json")
 .content("{"title":"   "}"))
 .andExpect(status().isBadRequest());
// Also assert the repository row count did not change.

What to expect

Inside a configured MockMvc test, use static imports from MockMvcRequestBuilders, MockMvcResultMatchers, and SecurityMockMvcRequestPostProcessors. Your account mapping must recognize the test principal.

YOUR TURN

Put it into practice

  1. 01Write HTTP tests for valid creation, blank title, missing identity, and wrong owner.
  2. 02Inspect response fields and database state for rejected requests.
  3. 03Verify: Security filters remain enabled and every denied mutation leaves data unchanged.

Pass a quiz or complete a lab to check today’s streak. Each lesson counts once per day, including when you review it later.

UNDER THE HOOD

Build the mental model

HTTP tests must exercise routing, conversion, validation, and the relevant filters together.

  1. 01MockMvc can run servlet request processing without a real network port. A narrow MVC slice is useful for controller contracts, while a full application test verifies broader wiring. Load the intended security configuration and avoid disabling filters merely to make tests pass.
  2. 02Use authenticated test users and CSRF support appropriate to the application. Test anonymous, authorized, and wrong-owner cases. Assert response body and persisted side effects; a status-only test can miss a write that incorrectly happened before rejection.
  3. 03Trace the example: Inside a configured MockMvc test, use static imports from MockMvcRequestBuilders, MockMvcResultMatchers, and SecurityMockMvcRequestPostProcessors. Your account mapping must recognize the test principal.

A mistake worth avoiding

A security regression is invisible because test filters are disabled.

DEBUGGING ROOM

Something broke. Where do you look?

A security regression is invisible because test filters are disabled.

Before revealing the diagnosis, write down your first investigation step.

CHECK YOUR UNDERSTANDING

Does calling a controller method directly prove the security filter chain works?

Choose one answer

BUILD IT YOURSELF

Write HTTP tests for valid creation, blank title, missing identity, and wrong owner.

  1. 1.Write HTTP tests for valid creation, blank title, missing identity, and wrong owner.
  2. 2.Inspect response fields and database state for rejected requests.
  3. 3.Reproduce this failure, then repair it: A security regression is invisible because test filters are disabled.

Acceptance checklist

Lab completion is your self-report. Knowledge checks do not certify project quality.

RETRIEVE IT FROM MEMORY

Does calling a controller method directly prove the security filter chain works?

Revisit this lesson in three days after a successful check or lab.

Ready for the next step?

Security filters remain enabled and every denied mutation leaves data unchanged.

Reading is separate from passing a knowledge check or completing a lab.

Go deeper · official references