In this video we're gonna look at the
solution to define the secret testing
challenge. So hopefully you are able to
solve that challenge on your own, and had
a bit of fun doing it.
But if you got stuck or if you just want
to see how I did it, feel free to follow
along here. So in the last video we
already saw how the profile is forbidden,
but how can we work around this? Now if
you want just a hint, you can use the
embed parameter. So if you remember in
the documentation we have this and bed
parameter available, and it has something
to do with this parameter. So if you just
want to pause and use that as a hint go
ahead and do that, but otherwise keep
following along for the full solution. So
we'll copy this, and we'll take it over
to Postman, and let's put it in here,
let's replace this and let's send that
command. So we can see that when we send
that command we get back the blog post,
and we also get back the comments that
are embedded under that blog post. So now
what if we did the same thing for
profile? What if we replace comments here
with profiles? Wonder what would happen
then? So if we send this, and voila we
have the secret profile ID, it's embedded
here in this. So by doing this we've
enabled it, we've been able to see the
details of this profile that was
supposed to be secret, that were not
authorized to see if we go directly to
it. And this example shows us why it's
important to figure out different paths
in the API.
Sometimes things are implemented only
assuming one path, so we want to make
sure that we consider other ways that
you might be able to get at some
information.
I hope this challenge has demonstrated
some of the intricacies of testing an
API, and I hope it has also got you
thinking about some of the approaches
you can take when testing GET calls. In
the next section we're going to dive in
a bit deeper, we're gonna look at testing
POST calls, so hope to see you there.