Authentication & Token Handling

Practice the following enterprise authentication exercises.

Exercise 1: Generate an Access Token

Generate an authentication token using the application's token generation API.

Exercise 2: Extract the Token Dynamically

Extract the generated token from the API response.

Advertisement

Exercise 3: Store the Token Securely

Store authentication tokens securely for reuse.

Exercise 4: Pass the Token to Secured APIs

Send the token through request headers when calling protected APIs.

Exercise 5: Validate Token Expiration

Verify application behavior when the token expires.

Exercise 6: Validate Invalid Token Behavior

Test requests using invalid authentication tokens.

Exercise 7: Validate Role-Based APIs

Verify API access for different user roles.

Exercise 8: Validate Multi-User Sessions

Test authentication across multiple user sessions.

Exercise 9: Validate Token Reuse

Reuse the same authentication token across multiple API requests.

Exercise 10: Validate Logout Invalidation

Verify that logout invalidates the authentication token.

Exercise 11: Validate Token Refresh

Validate the token refresh workflow.

Exercise 12: Handle Multiple Authentication Types

Practice authentication using:

Exercise 13: Secure Secrets in CI

Secure authentication secrets during CI/CD execution.

RESTful Booker Authentication Flow

Practice the following sequence:

  • Generate Token
  • Extract Token
  • Pass Token in Request Headers
  • Validate Expired Token
  • Validate Invalid Token
  • Reuse Token
  • Role-Based Validation
  • Logout Validation
  • Token Invalidation

Security & Access Scenarios

Practice the authentication and authorization scenarios from FakeStore Sprint-4.

Login Validation

  • Login using valid credentials.
  • Extract the authentication token dynamically.

Secured API Access

Pass the authentication token to secured APIs.

Invalid Login

Validate unsuccessful login attempts.

Expired Token

Verify expired-token behavior.

Token Reuse

Validate reuse of authentication tokens.

Logout Validation

Verify token invalidation after logout.

Unauthorized Access

Validate:

  • 401 Unauthorized

responses.

Forbidden Access

Validate:

  • 403 Forbidden

responses.

SQL Injection, XSS, and Unsupported HTTP Method validation belong to the Negative & Security practice cluster.

Response Validation

This is the most important validation module.

Practice validating every part of the API response.

Status Codes

Validate expected HTTP status codes.

Response Headers

Validate response headers.

Response Body

Validate:

  • Mandatory Fields
  • Response Values

Data Types

Validate field data types.

Nested Objects

Extract and validate nested JSON objects.

Arrays

Validate array sizes and contents.

Null vs Empty

Verify the difference between:

  • Null values
  • Empty values

Error Responses

Validate:

Business Error Messages

Validate business-specific error responses.

Conditional Responses

Validate responses that vary based on conditions.

Timestamps

Validate timestamp values.

Precision Values

Validate numeric precision where applicable.

Backward Compatibility

Verify response compatibility across API versions.

Response Time SLA

Validate response-time Service Level Agreements.

Assertions & Matchers

Use assertions to validate API responses accurately.

Hamcrest Matchers

Practice using:

  • equalTo()
  • contains()
  • hasSize()

Null Validation

Validate:

  • Null Values
  • Not Null Values

Regular Expression Validation

Use regex-based assertions.

Conditional Assertions

Validate responses conditionally.

Soft vs Hard Assertions

Practice both:

  • Soft Assertions
  • Hard Assertions

JSON Path

Use JSON Path to extract:

  • Single Values
  • Multiple Values
  • Nested Values

before performing assertions.

Demo-API Mapping

Authentication & Token Handling

Practice using:

  • restful-booker.herokuapp.com

Exercises include:

  • Token Generation
  • Header Authentication
  • Token Expiration
  • Token Reuse
  • Logout Validation

Secured API Access

Practice using:

  • fakestoreapi.com

Exercises include:

  • Login
  • Token Extraction
  • Secured APIs
  • 401 Validation
  • 403 Validation

Response Validation

Practice using:

  • dummyjson.com
  • jsonplaceholder.typicode.com

Exercises include:

FAQs

How Do You Handle a Token in REST Assured?

Generate the token using the authentication API, extract it dynamically from the response, store it securely, and include it in the Authorization header when calling secured APIs.

Which Token Scenarios Should You Test?

Practice:

  • Valid Token
  • Expired Token
  • Invalid Token
  • Token Reuse
  • Token Refresh
  • Logout Invalidation
  • Role-Based Access
  • Multi-User Sessions

What Is the Difference Between 401 and 403?

401 Unauthorized

  • Authentication is missing or invalid.

403 Forbidden

  • Authentication is valid, but the user does not have permission.

Which Response Validation Checks Are Most Important?

Validate:

  • Status Codes
  • Headers
  • Mandatory Fields
  • Data Types
  • Nested Objects
  • Arrays
  • Null vs Empty
  • Error Response Schema
  • Response Time SLA

How Do You Validate a Response Against a Contract?

Use JSON Schema Validation to verify that:

  • Required fields exist.
  • Data types are correct.
  • Response structure matches the agreed contract.

Which Matchers Are Commonly Used?

Practice Hamcrest matchers including:

  • equalTo()
  • contains()
  • hasSize()
  • notNullValue()

Also practice:

  • Regular Expression Validation
  • Conditional Assertions
  • JSON Path-based Assertions