Developer's 22 Passing Tests Still Missed a Real-World API Bug — Here's Why

·1 views

A developer with 22 passing tests and two code reviewers discovered a critical bug only when integrating with a live third-party API, where the parser expected ISO 8601 timestamps but the API returned Unix seconds. The flaw went undetected because both the parser and its test fixtures were written by the same person, encoding an identical wrong assumption, making the suite internally consistent but disconnected from reality. A separate security issue was also uncovered: Python 3.13's default redirect handler preserved API keys in headers across origins, a problem solvable with Request.add_unredirected_header(), which the developer had not used. The bugs were caught only through a real integration test conducted in collaboration with FIPSign, a third-party API provider who supplied disposable keys and stayed engaged for ten weeks. The episode highlights that internal test consistency does not guarantee correctness, and that live external validation can surface assumptions no amount of internal review will catch.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Build Reliable Notification Deduplication in Go Gaming Voice Lobbies

Notification deduplication in gaming voice lobbies requires treating event identity as a server-owned contract, not a transport guarantee. Each business event must be assigned a stable, unique ID before fan-out, and that ID must be reused on retries rather than regenerated. Clients should maintain a record of applied event IDs and share their last checkpoint upon reconnecting, allowing the server to reconcile state against durable events instead of inferring it from socket status. Fan-out operations must be designed to be idempotent, so repeated delivery attempts do not produce duplicate effects. The system's reliability rests on four clear invariants covering authorization, event identity, idempotent application, and separate audit trails for authentication, subscription, and delivery.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

5 Core JavaScript Concepts Intermediate Developers Should Deeply Understand

A technical guide published on DEV Community outlines five foundational JavaScript concepts that often trip up intermediate developers despite their practical experience. The topics covered include execution contexts and hoisting, where variables declared with var are initialized to undefined while let and const enter a Temporal Dead Zone before their declaration. The guide also breaks down the four primary rules governing the this keyword, noting that arrow functions lexically inherit this rather than defining their own. Closures are explained as a mechanism for retaining access to outer function variables even after execution ends, historically used to simulate private state. The article aims to help developers move beyond framework familiarity and build a stronger grasp of how JavaScript behaves under the hood.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Security Knowledge Is Now a Core Skill for Every Software Developer

The traditional model of handing off code to security teams just before release is increasingly seen as outdated and costly in modern software development. The 'Shift Left' philosophy advocates embedding security practices early in the development cycle, with IBM research suggesting fixes in production can cost up to 30 times more than those caught during design. Developers who understand attack vectors such as SQL injection, cross-site scripting, and insecure direct object references are better equipped to write secure code from the outset. Automated scanning tools, while useful, cannot detect context-specific business logic flaws that only a developer familiar with the application domain can identify and prevent. As software increasingly relies on open-source packages, security-aware developers are also better positioned to manage supply chain risks introduced through dependency ecosystems.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Keycloak Explained: Core IAM Concepts Developers Need for App Security

Keycloak is an open-source Identity and Access Management solution maintained by Red Hat that centralises authentication and authorisation for modern web applications. It supports industry standards including OAuth 2.0, OpenID Connect, and SAML 2.0, making it suitable for microservices, single-page applications, and mobile apps. The platform organises security through Realms, which are isolated management spaces for users, roles, and clients, with separate realms recommended for each application environment. Clients in Keycloak are categorised as public, confidential, or bearer-only depending on their ability to securely store credentials. A typical login flow involves redirecting users to Keycloak for authentication, issuing a short-lived authorisation code, and exchanging it for JWT-based access, ID, and refresh tokens used to secure API requests.

0 comments Read more at DEV Community