June 2015 Summaries

Headless browsers like Zombie.js are useful for integration testing Node.js web applications due to their speed and asynchronous nature. However, they may not always behave the same way as "real" browsers, leading to issues when testing third-party OAuth login flows. To overcome these challenges, developers can create test users, pre-approve their app in a real browser, peek at the page using browser.html(), change the user agent to mimic a modern desktop browser, and get creative with workarounds for specific issues. A GitHub repository demonstrates examples of logging into an application with Google and LinkedIn, which may be useful even when testing other social services.

Private GitHub organizations may not be as secure as expected due to the lack of third-party access policies, which allows applications to act on behalf of users with granted permissions. This can potentially include access to private repositories. GitHub does not have resource-specific scopes, so granting an application permission to manage issues requires giving them access to all resources. Organizations should check their configurations and implement access restrictions to protect proprietary code from bad actors.