A browser-assisted web application testing method and system

Abstract

This invention discloses a browser-assisted web application testing method and system, relating to the field of network security testing technology. The method includes: analyzing whether the target web application has JavaScript feature references and / or dependencies on dynamic fields, determining whether browser-assisted testing is required, and generating corresponding tagging data; a proxy server injects JavaScript code for handling replay requests into the browser instance of the target web application; the browser client parses the replay request, extracts dynamic fields from the current page of the browser instance, updates the parameters of the dynamic fields, and initiates a replay request to the target server based on the updated dynamic field parameters; and a testing tool performs defect logic detection on the target web application based on the response data of the replay request. This invention enables replay requests to bypass the target server's protection mechanisms, efficiently sending test traffic, avoiding redundant analysis, and improving the efficiency of the testing system.

Description

Technical Field

[0001] This invention relates to the field of network security testing technology, and in particular to a browser-assisted web application testing method and system. Background Technology

[0002] Traditional web application testing systems face numerous technical challenges when handling web applications. Traditional request replay tools employ a simple HTTP request copying mechanism, directly modifying parameters and replaying historical requests. However, this approach completely ignores the dynamic content generation and complex protection mechanisms of JavaScript widely used in modern web applications. Cookies, headers, and local storage in modern web applications often contain dynamic fields necessary for request verification. The values ​​of these fields change dynamically based on factors such as user session, timestamp, and random numbers. Traditional testing tools cannot recognize the existence of these dynamic fields, nor can they update test request parameters according to the actual values ​​in the current browser environment, causing test requests to fail due to verification failures. While manual testing tools can provide good testing results in certain scenarios, they require testers to perform detailed analysis and configuration of the technical characteristics of each target application. This approach is not only inefficient, but also increasingly costly to maintain as web application technologies rapidly evolve.

[0003] The aforementioned shortcomings in web application testing technologies have led to a significant decrease in test replay success rates. During automated test replay, the inability to handle dynamic protection mechanisms and dynamic field dependencies causes numerous test requests to fail due to verification failures, signature errors, token expiration, and other reasons, severely impacting test effectiveness. Furthermore, the inability to deeply analyze the target application's JavaScript characteristics and dynamic field dependencies prevents the testing system from building an effective application model, resulting in insufficient test coverage and difficulty in uncovering deep-seated application defects hidden within complex business logic. Summary of the Invention

[0004] In view of the above-mentioned defects or deficiencies in the prior art, the present invention provides a browser-assisted web application testing method and system to solve the above-mentioned technical problems mentioned in the background art.

[0005] One aspect of the present invention provides a browser-assisted web application testing method, comprising the following steps:

[0006] The testing tool sends a test request to the target server of the target web application and receives the response headers and content returned by the target server. Based on the response content, it analyzes whether the target web application contains JavaScript feature references and whether there are dependencies on dynamic fields based on the request content. If JavaScript feature references and / or dependencies on dynamic fields exist, it generates tag data that requires browser-assisted testing and saves the tag data to the tag database corresponding to the target web application. Finally, it sends a replay request for the test request to the proxy server.

[0007] The proxy server receives and analyzes the replay request sent by the testing tool. If the target web application for which the replay request is sent contains tag data, it injects JavaScript code to the browser instance of the target web application to handle the replay request.

[0008] The browser client receives and executes the JavaScript code, establishes a WebSocket connection between the proxy server and the browser instance, receives and parses the replay request forwarded by the proxy server through the WebSocket connection, extracts the dynamic fields of the current page of the browser instance and updates the parameters of the dynamic fields, and sends a real replay request to the target server based on the updated dynamic field parameters.

[0009] The browser client receives the response data of the replay request returned by the target server and forwards the response data to the proxy server; the proxy server forwards the response data to the testing tool, and the testing tool performs defect logic detection on the target web application based on the response data.

[0010] In another aspect, the present invention provides a browser-assisted web application testing system, comprising:

[0011] The testing tool is used to send test requests to the target server of the target web application and receive the response headers and content returned by the target server; analyze whether the target web application has JavaScript feature references based on the response content, and analyze whether there are dynamic field dependencies based on the request content; if JavaScript feature references and / or dynamic field dependencies exist, it generates tag data that requires browser-assisted testing and saves the tag data to the tag database corresponding to the target web application; it sends a replay request of the test request to the proxy server, and performs defect logic detection of the target web application based on the response data of the replay request forwarded by the proxy server;

[0012] The proxy server is used to receive and analyze replay requests sent by the testing tool. If the target web application for which the replay request is sent contains tag data, it injects JavaScript code for handling the replay request into the browser instance of the target web application. It also receives response data of the replay request forwarded by the browser client and forwards the response data to the testing tool.

[0013] The browser client is used to receive and execute the JavaScript code, establish a WebSocket connection between the proxy server and the browser instance, receive and parse the replay request forwarded by the proxy server through the WebSocket connection, extract the dynamic fields of the current page of the browser instance and update the parameters of the dynamic fields, initiate a real replay request to the target server according to the updated dynamic field parameters, receive the response data of the replay request returned by the target server, and forward the response data to the proxy server.

[0014] The target server is used to receive the test request and return the response header and response content of the test request to the test tool; it also receives the actual replay request initiated by the browser client and returns the response data of the replay request to the browser client.

[0015] The browser-assisted web application testing method and system provided by this invention analyzes the dependencies between dynamic fields and request parameters by detecting features such as specific JavaScript library references, dynamic script loading, and key function calls, and by establishing a dynamic field analysis system including cookies, headers, and browser state libraries. This determines whether browser assistance is needed and establishes a labeled database containing test target features. The persistent labeled data in the database is used both to determine whether browser assistance is needed and to indicate which fields should be dynamically updated during replay requests. These measures enable replay requests to bypass the target server's protection mechanisms, efficiently send test traffic, avoid redundant analysis, and significantly improve the efficiency of the testing system. Attached Figure Description

[0016] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0017] Figure 1 This is a schematic diagram of the structure of a browser-assisted web application testing system provided in one embodiment of this application;

[0018] Figure 2 This is a timing flowchart of each part of a browser-assisted web application testing system provided in one embodiment of this application;

[0019] Figure 3 This is a flowchart illustrating a browser-assisted web application testing method provided in one embodiment of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” used in the embodiments of this invention are also intended to include the plural forms unless the context clearly indicates otherwise.

[0022] One embodiment of the present invention provides a browser-assisted web application testing system 100, the logical architecture of which is described below. Figure 1 .

[0023] The testing system 100 includes a testing tool 101, a proxy server 102, a browser client 103, a target web application (e.g., a website) to be tested, and a target server 104 for the target web application. The testing tool 101 can be an app or other software program used for website testing. The proxy server 102 logically sits between the testing tool 101 and the browser client. The testing tool 101, the browser client, and the target web application to be tested can be installed on the same computer device or on different computer devices.

[0024] The following is based on Figure 2 The timing logic shown provides a detailed description of the functions of each component of the test system 100.

[0025] The testing tool 101 is used to send a test request to the target server 104 of the target web application and receive the response headers and response content returned by the target server 104; analyze whether the target web application has JavaScript feature references based on the response content, and analyze whether there are dynamic field dependencies based on the request content; if there are JavaScript feature references and / or dynamic field dependencies, generate tag data that requires browser-assisted testing, and save the tag data to the tag database corresponding to the target web application; send a replay request of the test request to the proxy server 102, and perform defect logic detection of the target web application based on the response data of the replay request forwarded by the proxy server 102.

[0026] The tagged data includes: the domain name of the target web application, a list of JavaScript dynamic reference characteristics, a dictionary containing each dynamic field, a tag indicating whether browser assistance is enabled, analysis time, and validity period, etc. The tagged data can determine whether browser assistance is needed and also indicate which fields should be dynamically updated during replay requests. The tagged data in this database is persistent and can be used as the basis for querying whether browser assistance is needed during each replay request, avoiding redundant analysis.

[0027] Furthermore, the testing tool 101 is also used to identify all JavaScript scripts and referenced JavaScript files contained in the target web application through the response content, and to analyze whether the target web application contains frameworks and / or middleware with specific browser behavior dependencies through feature detection. If so, it generates marked data that requires browser-assisted testing. It also compares whether there are response differences when the target web application is opened with a browser and when it is opened without a browser. If so, it generates marked data that requires browser-assisted testing. The testing tool 101 identifies JavaScript feature references through the above two methods. When either method meets the conditions, it can be determined that the replay request of the current target web application requires browser assistance, so as to update the test request parameters according to the actual values ​​in the current browser environment.

[0028] Furthermore, the testing tool 101 is also used to detect whether cookies contain dynamic features, analyze the generation patterns and update frequency of cookies, and generate marked data that requires browser assistance for testing if the cookie contains dynamic features or is dynamically updated. It also identifies whether there are dynamic signature headers and timestamp headers in the request headers; if so, it generates marked data that requires browser assistance for testing. Finally, it analyzes whether fields in the request headers and request body have the same field names and values ​​as fields stored in the browser's state library (localStorage, sessionStorage, and Window object); if so, it generates marked data that requires browser assistance for testing. The testing tool 101 identifies the dependencies of dynamic fields through these three methods. When any of these methods meet the conditions, it can be determined that the replay request of the current target web application requires browser assistance, so as to update the test request parameters according to the actual values ​​in the current browser environment.

[0029] The proxy server 102 is used to receive and analyze the replay request sent by the test tool 101. If there is tag data in the tag database of the target web application for which the replay request is targeted, the proxy server 102 injects JavaScript code for handling the replay request into the browser instance of the target web application (an independent, running browser process and its associated execution environment). The proxy server 102 receives the response data of the replay request forwarded by the browser client 103 and forwards the response data to the test tool 101.

[0030] It's important to note that the injected JavaScript code contains the specific processing logic for request replay. It's responsible for editing the sent request and processing the received response, essentially handling some of the proxy application's logic. Injecting JavaScript code into the browser executes it within the webpage to implement the processing logic.

[0031] Browser client 103 is used to receive and execute the JavaScript code, establish a WebSocket connection between proxy server 102 and browser instance, receive and parse replay requests forwarded by proxy server 102 through the WebSocket connection, extract dynamic fields of the current page of browser instance and update the parameters of dynamic fields, initiate a real replay request to target server 104 according to the updated dynamic field parameters, receive response data of replay request returned by target server 104, and forward the response data to proxy server 102.

[0032] Specifically, browser client 103 parses the replay request, finds the latest value in the dynamic field association state library in the current browser instance according to the dynamic field recorded in the marked data, and replaces or supplements the corresponding field value in the replay request with the latest value, thereby realizing the dynamic field parameter update.

[0033] It should be noted that the WebSocket connection is mainly used to enable bidirectional communication between the proxy server 102 and the browser client 103. This embodiment, based on WebSocket bidirectional communication and JavaScript injection, achieves seamless collaboration between the proxy server 102 and the browser client 103, ensuring the correct processing of dynamic fields and the successful execution of requests during traffic replay.

[0034] The target server 104 is used to receive the test request and return the response header and response content of the test request to the test tool 101; it also receives the real replay request initiated by the browser client 103 and returns the response data of the replay request to the browser client 103.

[0035] This invention addresses the testing needs of web applications and adopts a layered logical architecture design at the software level, mainly including the following core components:

[0036] (1) Test target analysis and decision-making level

[0037] Target Web Application Feature Recognition Module: Automatically analyzes the JavaScript features and dynamic field dependencies of the test target;

[0038] Dynamic field analyzer: Identifies and analyzes dynamic fields such as cookies, request headers, and local storage of the target web application;

[0039] Target Web Application Tagging Module: Stores and manages information on the technical characteristics and processing strategies of the target web application being tested;

[0040] (2) Test request proxy layer

[0041] Test request interception module: Intercepts all HTTP / HTTPS requests sent by testing tools;

[0042] Request replay classifier: Classifies and labels test requests, and selects direct replay / browser-assisted replay;

[0043] Test processing method selector: Supports specifying rules or automatically selecting test processing methods;

[0044] (3) Browser-assisted testing layer

[0045] On-demand Browser Manager: Dynamically start and manage browser testing environments based on testing needs;

[0046] The communication browser pool scheduling module allocates browser resources based on test request characteristics.

[0047] Request management module: Provides a two-way communication channel between the test request proxy and the browser;

[0048] (4) Dynamic field processing layer (located in the browser)

[0049] Dynamic field extraction module: Extracts dynamic field values ​​from local storage, cookies, and headers;

[0050] Request parameter updater: Updates the Header, Body, and Query parameters of the test request based on dynamic field values;

[0051] Response Modifier: Modify the test response content as needed.

[0052] This embodiment analyzes the dependencies between dynamic fields and request parameters by detecting features such as specific JavaScript library references, dynamic script loading, and key function calls, and by establishing a dynamic field analysis system including cookies, headers, and browser state libraries. This determines whether browser assistance is needed and establishes a tag database containing test target features. The persistent tag data in the database is used both to determine whether browser assistance is needed and to indicate which fields should be dynamically updated during replay requests. These measures in this embodiment allow replay requests to bypass the target server's protection mechanisms, efficiently send test traffic, avoid redundant analysis, and significantly improve the efficiency of the testing system.

[0053] See Figure 3 Another embodiment of the present invention also provides a browser-assisted web application testing method, which specifically includes the following steps:

[0054] Step S101: The testing tool sends a test request to the target server of the target web application and receives the response header and response content returned by the target server; it analyzes whether the target web application has JavaScript feature references based on the response content and whether there are dynamic field dependencies based on the request content; if there are JavaScript feature references and / or dynamic field dependencies, it generates tag data that requires browser-assisted testing and saves the tag data to the tag database corresponding to the target web application; it sends a replay request for the test request to the proxy server.

[0055] The purpose of this step is to analyze the JavaScript characteristics and dynamic field dependencies of the target web application (e.g., a website), determine whether the target web application needs browser-assisted testing based on the analysis results, and mark it to provide processing strategy options for subsequent test replay.

[0056] For example, a test request is sent to the test website, and the response content and HTTP request header information of the test request are analyzed, including:

[0057] (1) Analyze all JavaScript scripts and referenced JavaScript files on the target website. Due to factors such as frames and middleware, these files may provide the same or even similar content on different websites, or have specific textual characteristics. Therefore, feature detection methods can be used to analyze whether the website contains specific frames or middleware. These frames and middleware have fixed browser behavior dependencies. By identifying these features, it can be directly determined that the website needs to use browser-assisted testing (i.e., browser-assisted sending of test requests).

[0058] (2) Detect the key response status of the website. Since the response of the target website is very different when it is opened in a browser and when it is opened in a non-browser (through bash command, etc.), by judging the degree of response difference, it is also possible to identify whether the target website needs browser-assisted testing.

[0059] (3) Detect whether the cookie contains dynamic features, analyze the generation pattern and update frequency of the cookie. If the cookie contains dynamic features or is dynamically updated, generate marker data that requires browser assistance for testing. The principle of this method is: by default, browsers do not update all fields in the request, but usually only update cookies. Therefore, once dynamic features or dynamic updates are found in the cookie, it indicates that the website requires browser assistance for testing.

[0060] (4) Identify whether there are dynamic signature headers and timestamp headers in the request headers. If so, generate marker data that requires browser assistance for testing. The principle of this analysis method is that the browser needs to update the signature header and timestamp header in the request headers. Once they are dynamically updated, it indicates that browser assistance for testing is required.

[0061] (5) Analyze whether the fields in the request headers and request body have the same field names and values ​​as the fields stored in the browser's state library localStorage, sessionStorage, and Window object. If so, generate marker data that requires browser-assisted testing. The principle of this analysis method is: when the field names and values ​​in the request headers are the same as those stored in the browser or window object properties, it can be inferred that these values ​​may have been automatically set or modified by the browser environment, that is, the browser automatically added these request headers. Therefore, through the above analysis process, it can be determined whether the website requires browser-assisted testing.

[0062] By employing the five analysis and judgment methods described above, it can be determined whether a website requires browser-assisted testing. If so, tagged data is generated and saved to a local tag database corresponding to the website. It should be noted that the tag data includes: the target web application's domain name, a list of JavaScript dynamic reference characteristics, a dictionary containing each dynamic field, tags indicating whether browser assistance is enabled, analysis time, and validity period, etc. The tag data not only determines whether browser assistance is needed but also indicates which fields should be dynamically updated during replay requests. This tag data in the tag database is persistent and can be used as the basis for querying and determining whether browser assistance is needed during each replay request, avoiding redundant analysis.

[0063] Below is a code example of the structure of the website's tag data:

[0064] {

[0065] "target_domain": "testapp.example.com",

[0066] "js_features": {

[0067] "dynamic_cookies": true,

[0068] },

[0069] "dynamic_fields": {

[0070] "dynamic_headers":{"X-Signature":"localstorage_aKeySignature", "Authorization":"localstorage_session", …},

[0071] },

[0072] "recommended_strategy": "browser_assist_required",

[0073] "last_analyzed": "2024-01-15T10:30:00Z"

[0074] }

[0075] After the aforementioned preliminary analysis and labeling process is completed, the testing tool can send a replay request for the test request to the proxy server.

[0076] In step S102, the proxy server receives and analyzes the replay request sent by the testing tool. If the target web application for which the replay request is sent contains tag data, the proxy server injects JavaScript code to the browser instance of the target web application to handle the replay request.

[0077] Specifically, after receiving a replay request, the proxy server analyzes the tag data in the tag database of the website targeted by the replay request. If the tag data shows that browser assistance is needed for testing, the proxy server injects JavaScript code into the browser instance. The injected JavaScript code is the specific processing logic for the replay request; it is responsible for editing the sent request and processing the received response. It undertakes part of the proxy application's logic, and the injected JavaScript code will execute in the website's webpage.

[0078] In step S103, the browser client receives and executes the JavaScript code, establishes a WebSocket connection between the proxy server and the browser instance, receives and parses the replay request forwarded by the proxy server through the WebSocket connection, extracts the dynamic fields of the current page of the browser instance and updates the parameters of the dynamic fields, and initiates a real replay request to the target server based on the updated dynamic field parameters.

[0079] Specifically, the browser client executes the JavaScript code on the browser instance that opens the website, establishing a WebSocket connection between the proxy server and the browser instance. The WebSocket connection is primarily used to enable bidirectional communication between the proxy server and the browser client. Based on WebSocket bidirectional communication and JavaScript injection, seamless collaboration between the proxy server and the browser client is achieved, ensuring the correct processing of dynamic fields and the successful execution of requests during traffic replay. Specifically, the browser client parses the replay request, finds the latest value in the dynamic field association state library in the current browser instance according to the dynamic fields recorded in the marked data, and replaces or supplements the corresponding field value in the replay request with this latest value.

[0080] For example, updating the parameters of a dynamic field includes the following steps:

[0081] 1. Obtain all the tag data corresponding to the website. The dynamic field dictionary in the tag data contains all the fields that need to be dynamically updated.

[0082] 2. Based on the names of all fields in the marked data that need to be dynamically updated, find the relevant fields in the replay request or determine the relevant fields that are missing in the replay request;

[0083] 3. Locate the latest value in the associated state library for the relevant field within the current browser environment;

[0084] 4. Replace or supplement the corresponding field parameter values ​​in the replay request.

[0085] Finally, a real replay request is sent to the target server based on the updated dynamic field parameters.

[0086] In step S104, the browser client receives the response data of the replay request returned by the target server and forwards the response data to the proxy server; the proxy server forwards the response data to the testing tool, and the testing tool performs defect logic detection on the target web application based on the response data.

[0087] The above description is merely a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to the specific combination of the above-described technical features, but should also cover other technical solutions formed by any combination of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A browser-assisted web application testing method, characterized in that, Includes the following steps: The testing tool sends a test request to the target server of the target web application and receives the response headers and content returned by the target server. Based on the response content, it analyzes whether the target web application has JavaScript feature references and whether there are dynamic field dependencies. If JavaScript feature references and / or dynamic field dependencies exist, it generates tag data that requires browser-assisted testing and saves the tag data to the tag database corresponding to the target web application. Send a replay request for the test request to the proxy server; The proxy server receives and analyzes the replay request sent by the testing tool. If the target web application for which the replay request is sent contains tag data, it injects JavaScript code to the browser instance of the target web application to handle the replay request. The browser client receives and executes the JavaScript code, establishes a WebSocket connection between the proxy server and the browser instance, receives and parses the replay request forwarded by the proxy server through the WebSocket connection, extracts the dynamic fields of the current page of the browser instance and updates the parameters of the dynamic fields, and sends a real replay request to the target server based on the updated dynamic field parameters. The browser client receives the response data of the replay request returned by the target server and forwards the response data to the proxy server; The proxy server forwards the response data to the testing tool, which then performs defect logic detection on the target web application based on the response data.

2. The browser-assisted web application testing method according to claim 1, characterized in that, Based on the response content, analyze whether the target web application contains JavaScript signature references, including: The response content identifies all JavaScript scripts and referenced JavaScript files contained in the target web application. The feature detection method is used to analyze whether the target web application contains frameworks and / or middleware that depend on specific browser behaviors. If so, tagged data that requires browser-assisted testing is generated. Compare whether there are differences in the response of the target web application when it is opened with a browser and when it is opened with a non-browser. If so, generate labeled data that requires browser-assisted testing.

3. The browser-assisted web application testing method according to claim 1, characterized in that, Analyze the request content to determine if there are dependencies on dynamic fields, including: Detect whether the cookie contains dynamic features, analyze the cookie's generation pattern and update frequency, and if the cookie contains dynamic features or is dynamically updated, generate tag data that requires browser assistance for testing. If a dynamic signature header and timestamp header are found in the request header, then markup data that requires browser assistance for testing is generated. Analyze whether the fields in the request header and request body have the same field names and values ​​as the fields stored in the browser's state library localStorage, sessionStorage, and Window object. If so, generate markup data that requires browser assistance for testing.

4. A browser-assisted web application testing method according to any one of claims 1-3, characterized in that, The tagging data includes: the domain name of the target web application, a list of JavaScript dynamic reference characteristics, a dictionary of dynamic fields, a tag indicating whether browser assistance is enabled, the analysis time, and the validity period.

5. The browser-assisted web application testing method according to claim 4, characterized in that, Extracting and updating the parameters of the dynamic fields of the current page of the browser instance, including: Based on the dynamic fields recorded in the tagged data, find the latest value in the dynamic field association state library in the current browser instance, and replace or supplement the corresponding field value in the replay request with the latest value.

6. A browser-assisted web application testing system, characterized in that, include: The testing tool is used to send test requests to the target server of the target web application and receive the response headers and response content returned by the target server. Based on the response content, analyze whether the target web application has JavaScript feature references, and based on the request content, analyze whether there are dynamic field dependencies; if there are JavaScript feature references and / or dynamic field dependencies, generate tag data that requires browser-assisted testing, and save the tag data to the tag database corresponding to the target web application; Send a replay request of the test request to the proxy server, and perform defect logic detection on the target web application based on the response data of the replay request forwarded by the proxy server. The proxy server is used to receive and analyze replay requests sent by the testing tool. If the target web application for which the replay request is sent contains tag data, JavaScript code for handling the replay request is injected into the browser instance of the target web application. Receive response data from the replay request forwarded by the browser client, and forward the response data to the test tool; The browser client is used to receive and execute the JavaScript code, establish a WebSocket connection between the proxy server and the browser instance, receive and parse the replay request forwarded by the proxy server through the WebSocket connection, extract the dynamic fields of the current page of the browser instance and update the parameters of the dynamic fields, initiate a real replay request to the target server according to the updated dynamic field parameters, receive the response data of the replay request returned by the target server, and forward the response data to the proxy server. The target server is used to receive the test request and return the response header and response content of the test request to the test tool; It receives the actual replay request initiated by the browser client and returns the response data of the replay request to the browser client.

7. The browser-assisted web application testing system according to claim 6, characterized in that, The testing tool is also used for: The response content identifies all JavaScript scripts and referenced JavaScript files contained in the target web application. The feature detection method is used to analyze whether the target web application contains frameworks and / or middleware that depend on specific browser behaviors. If so, tagged data that requires browser-assisted testing is generated. Compare whether there are differences in the response of the target web application when it is opened with a browser and when it is opened with a non-browser. If so, generate labeled data that requires browser-assisted testing.

8. The browser-assisted web application testing system according to claim 6, characterized in that, The testing tool is also used for: Detect whether the cookie contains dynamic features, analyze the cookie's generation pattern and update frequency, and if the cookie contains dynamic features or is dynamically updated, generate tag data that requires browser assistance for testing. If a dynamic signature header and timestamp header are found in the request header, then markup data that requires browser assistance for testing is generated. Analyze whether the fields in the request header and request body have the same field names and values ​​as the fields stored in the browser's state library localStorage, sessionStorage, and Window object. If so, generate markup data that requires browser assistance for testing.

9. A browser-assisted web application testing system according to any one of claims 6-8, characterized in that, The tagging data includes: the domain name of the target web application, a list of JavaScript dynamic reference characteristics, a dictionary of dynamic fields, a tag indicating whether browser assistance is enabled, the analysis time, and the validity period.

10. A browser-assisted web application testing system according to claim 9, characterized in that, Browser clients are also used for: Based on the dynamic fields recorded in the tagged data, find the latest value in the dynamic field association state library in the current browser instance, and replace or supplement the corresponding field value in the replay request with the latest value.

Images