Testing of Shared key Authentication
em-abee opened this issue · 1 comments
em-abee commented
Recently, Shared Key Authentication for the BPP webhook was released. Testing is required to validate the implementation. Below are the test cases:
- While sending a request to the BPP Webhook protocol server, it should not include an authorization header if HMAC settings are disabled in the config.
- The protocol server should include an authorization header with the signature as its value if HMAC settings are enabled.
- The BPP should receive an authorization header that contains the signature.
- The BPP should be able to verify the message using the shared key.
- Verification should fail on the BPP when the shared key is invalid.
em-abee commented
Testing above scenarios on local and dev environment, results are as expected. Closing ticket