Integration testing Google Signin JWT id token with backend API

Viewed 358

I have an API that accepts google id tokens in the standard way described here.

  1. user opens Google oAuth popup and selects account
  2. popup closes resolving with google id JWT
  3. JWT is sent to my API /login or /register endpoint
  4. backend decodes and verifies the JWT then uses the contained claims to register or log the user in accordingly.

I also have a suite of simple integration tests that run against the API including tests for whether it can register or log a user in using an email/password.

I'd like to write tests for whether /login and /register work correctly with google JWT but I can't think of a way given that JWT by design are only valid when signed by Google which I can't get in automated tests. My current ideas:

  • config of some kind that skips JWT verification in dev/test mode - this would work but introducing a potential security vulnerability for the sake of a test feels like a code smell
  • not testing :(

Any ideas?

0 Answers
Related