My Tests Agreed With My Code. Neither of Them Checked Reality

说明与用途

测试和评审通过，但代码在真实 API 上失败，原因是对时间戳格式和头部处理的错误假设。实际测试发现两处缺陷：时间戳不匹配和重定向时 API 密钥泄露。修复包括更新解析器、保护头部并设置自定义 User‑Agent。

问题

Unit tests and code reviews passed, but the code failed against a real external API due to incorrect assumptions about data format and header handling.

结果

Two critical defects were uncovered only through live integration: a timestamp format mismatch and improper header forwarding on redirects. Fixing these required updating the parser, adding redirect‑safe headers, and setting a custom User‑Agent. The experience underscored the limitations of internal tests and the value of testing against real external systems.

工作流

• 1. Ran local test suite – all green.
• 2. Pointed code at real API – first live read failed due to timestamp mismatch.
• 3. Reviewed parser and fixtures – both assumed ISO 8601.
• 4. Identified redirect issue – urllib forwarded X-API-Key on redirects.
• 5. Engaged external collaborator (FIPSign) – obtained disposable API keys and performed live tests.
• 6. Determined User‑Agent header was missing, causing bot‑flagging.
• 7. Added custom User‑Agent and used add_unredirected_header for X-API-Key.
• 8. Re‑ran live integration – all stages succeeded (201, 200, 200, 200).
• 9. Documented findings and lessons learned.
• 10. Reflected on testing practices – highlighted need for live system tests and independent fixtures.

证据

My tests used ISO because my code used ISO, so they agreed with each other and never checked reality.

来源

No live FIPSign credential was ever shown to have crossed an origin.

来源

If you are hitting an endpoint from a script and getting bot-flagged for no visible reason, check what user agent your HTTP library is sending by default.

来源