# Microusity: A testing tool for Backends for Frontends (BFF) Microservice Systems

**Authors:** Pattarakrit Rattanukul, Chansida Makaranond, Pumipat Watanakulcharus, Chaiyong Ragkhitwetsagul, Tanapol Nearunchorn, Vasaka Visoottiviseth, Morakot Choetkiertikul, Thanwadee Sunetnanta  
**arXiv:** [2302.11150](https://arxiv.org/abs/2302.11150)  
**Date:** 2023-02-22  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/2302.11150v1/

## Key points

- Microservice software architecture is popular for its scalability and efficiency compared to monolithic designs
- Adoption of microservices introduces unique security concerns
- Microusity is a tool designed for testing RESTful APIs in a microservice pattern called back end for front end (BFF)
- Microusity traces BFF requests by mapping port connections between BFF requests and sub-requests sent to back-end microservices
- The tool helps pinpoint specific back-end services causing internal server errors, unhandled errors, or vulnerabilities
- Provides an error report with overall test summary, number of error responses from BFF and back-end microservices, and categorized request sequence
- Offers a graph report that visualizes the relationship between main requests, sub-requests, and their corresponding responses
- Graph report helps trace connections between requests and identify exception message leakage or HTTP 5xx responses indicating server errors
- User evaluation with eight software practitioners found Microusity's error reports and graph visualization valuable for investigating and understanding problems in BFF systems.

## Summary

The microservice software architecture has gained popularity due to its scalability and efficiency compared to monolithic designs. However, the adoption of microservices also introduces unique security concerns. To address these issues, we propose Microusity, a tool specifically designed for testing RESTful APIs in a microservice pattern called back end for front end (BFF). Microusity utilizes a novel approach to trace BFF requests by mapping the port connections between BFF requests and the sub-requests sent to back-end microservices. This allows developers to pinpoint which specific back-end service is causing internal server errors, which could potentially lead to unhandled errors or vulnerabilities. The tool provides an error report that includes an overall test summary, the number of error responses from both the BFF and back-end microservices, and a request sequence categorized into different types of issues. Additionally, Microusity offers a graph report that visualizes the relationship between main requests, sub-requests, and their corresponding responses. This graph report helps developers easily trace connections between requests and identify any exception message leakage or HTTP 5xx responses indicating server errors. To evaluate the effectiveness of Microusity, we conducted a user evaluation with eight software practitioners. The evaluation included demonstrations and interviews to assess the ease of understanding and usefulness of the tool. Overall, participants found Microusity's error reports and graph visualization valuable for investigating and understanding problems in BFF systems. For more information about Microusity and access to the prototype tool and video demo, please visit our GitHub repository at https://github.com/MUICT-SERU/MICROUSITY.