MockServer 7.3.0: Enhanced Control & Critical Security Updates

Release Date: 2026-07-01 | Category: Mobile and API Testing

TL;DR

  • New typed client methods simplify control-plane operations across all client libraries.
  • Enhanced security: improved sensitive data redaction in recorded traffic.
  • Multiple critical security fixes addressing authentication, authorization, and potential vulnerabilities.

Key Changes

MockServer 7.3.0, a significant update from 7.2.0, focuses on improving usability for QA engineers and strengthening security. For full details, refer to the official MockServer changelog.

New Features

This release introduces typed client methods for various control-plane operations. QA engineers can now manage clock control, metrics, configuration, Pact interactions, file storage, HAR/Postman imports, high-level operating modes (SIMULATE/SPY/CAPTURE), and WSDL expectation generation directly via client libraries (Java, Node, Python, Ruby, Go, .NET, Rust, PHP). This eliminates the need for manual PUT /mockserver/... REST calls, streamlining test setup and maintenance.

Security Enhancements

A major focus of 7.3.0 is security. Fixture redaction now covers query strings and streamed bodies, automatically masking credential-bearing parameters (e.g., api_key, token) and configured fields within Server-Sent-Events data: payloads. It also fails closed on unparseable secrets, preventing leaks. Several authorization gaps were closed: /bind and /stop endpoints, along with MCP tool calls, now honor control-plane authentication/authorization. JWT validation cross-request race conditions were fixed, and remote JWKS/OIDC discovery fetches are now bounded to prevent denial-of-service. Crucially, a Server-Side Request Forgery (SSRF) / local-file-disclosure vector via Apache Velocity templates was removed, and mTLS control-plane authentication now rejects expired client certificates.

Impact for QA Teams

This update simplifies test automation by providing direct client access to control-plane functions, reducing boilerplate code and making test scripts cleaner. The extensive security fixes enhance the integrity and safety of mock environments, especially when handling sensitive data or operating in secure contexts. QA teams can expect more secure and efficient mock setups, reducing risks associated with data exposure and unauthorized access.

FAQ

  • Q: What are “typed client methods”?
    • A: They are dedicated functions in client libraries that replace manual REST calls for MockServer control operations, making code cleaner and less error-prone.
  • Q: How does improved redaction help QA?
    • A: It automatically masks sensitive data (like API keys in URLs or streamed bodies) when importing or capturing traffic, reducing the risk of accidental exposure in test artifacts.
  • Q: Is upgrading mandatory?
    • A: Given the numerous security fixes, upgrading to 7.3.0 is highly recommended, especially if your MockServer instance is exposed or handles sensitive data.