I am trying to clear up a doubt on security testing.
If the web app (GUI, functional UIs, user roles, et all), makes use of rest web services to take actions, I believe both the web app AND the web services should be tested.
The vendor team, however, insists otherwise, and just want web app to be tested, and leave the web services out.
Can someone pls confirm if I am correct & both web app & web services must be reviewed? Thnx.
Update: Adding more info on this.
The vendor is a third-party, who has written this app for one of our teams. The team has asked me directions and next steps for ensuring security in this app. I am recommending that we get a pentest done against this app (both web app & web services), identify the security issues, and tell the vendor to fix stuff, instead of I just signing off on a poorly written app.
Vendor insists we stick to web app pentest and not web services security, as testing both is not necessary.