API Testing · Senior · Question 61 of 75

How do you test that an API never returns data from a cache after a user's permissions change?

1Permission changes take effect only after a server restart
2Revoke access, then request again and check denial, including via CDN
3Check permissions only once at login and trust caches afterwards

Show the answer

Correct answer: Revoke access, then request again and check denial, including via CDN

Explanation

Cached authorization decisions or responses can keep exposing data. Tests change roles mid-session and check every layer.

Further reading

Test yourself

Take the API Testing · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.