I have an API that accepts google id tokens in the standard way described here.
- user opens Google oAuth popup and selects account
- popup closes resolving with google id JWT
- JWT is sent to my API
/loginor/registerendpoint - backend decodes and verifies the JWT then uses the contained claims to register or log the user in accordingly.
I also have a suite of simple integration tests that run against the API including tests for whether it can register or log a user in using an email/password.
I'd like to write tests for whether /login and /register work correctly with google JWT but I can't think of a way given that JWT by design are only valid when signed by Google which I can't get in automated tests. My current ideas:
- config of some kind that skips JWT verification in dev/test mode - this would work but introducing a potential security vulnerability for the sake of a test feels like a code smell
- not testing :(
Any ideas?