Authentication & Token Handling
Practice enterprise authentication scenarios using REST Assured.
Token Generation
Practice the following exercises:
- Generate an Access Token
- Generate Authentication Token
- Generate JWT Token
Token Extraction
Extract the generated token dynamically from the API response.
Secure Token Storage
Store authentication tokens securely before using them in subsequent API requests.
Pass Token in Requests
Pass the generated token using the Authorization header for secured API access.
Token Expiration
Validate application behavior when an authentication token expires.
Invalid Token Validation
Verify API responses when invalid or modified tokens are supplied.
Role-Based Access
Validate API behavior for different user roles.
Multi-User Sessions
Validate authentication for multiple concurrent users.
Token Reuse
Reuse the generated token across multiple API requests.
Logout Validation
Validate that logout invalidates the authentication token.
Refresh Token Flow
Validate token refresh functionality.
Multiple Authentication Types
Practice authentication using:
- Basic Authentication
- Bearer Token
- OAuth 2.0
- JWT
Secure Secrets
Store authentication credentials securely during CI/CD execution.
Restful Booker Authentication Flow
Practice the following workflow.
Generate Token
↓
Extract Token
↓
Store Token
↓
Pass Authorization Header
↓
Access Secured APIs
↓
Validate Token Reuse
↓
Validate LogoutSecurity & Access Validation
Practice secured API validation using the FakeStore project.
Authentication Flow
Practice:
- Valid Login
- Invalid Login
- Token Generation
- Token Extraction
- Secured API Access
Token Validation
Practice:
- Expired Token
- Invalid Token
- Token Reuse
- Logout Validation
Access Validation
Verify API responses for:
- Unauthorized Access (401)
- Forbidden Access (403)
Response Validation
Practice validating API responses returned from backend services.
Status Code Validation
Validate expected HTTP status codes.
Header Validation
Validate response headers returned by the API.
Response Body Validation
Validate:
- Mandatory Fields
- Response Values
- Business Data
Data Type Validation
Verify returned data types.
Nested JSON Validation
Extract and validate nested JSON objects.
Array Validation
Validate response arrays including:
- Array Size
- Array Values
Null & Empty Validation
Verify:
- Null Values
- Empty Values
JSON Schema Validation
Validate:
- JSON Schema
- Error Response Schema
- Response Contract
Business Error Validation
Validate business-specific error messages.
Conditional Validation
Validate responses under different conditions.
Timestamp Validation
Validate timestamp values.
Precision Validation
Validate decimal and precision values.
Backward Compatibility
Verify API compatibility with existing response structures.
Response Time Validation
Validate API response time against expected SLA requirements.
Assertions & Matchers
Use assertions to validate API responses accurately.
Hamcrest Matchers
Practice using:
- equalTo()
- contains()
- hasSize()
Null Validation
Validate:
- null
- notNull
Regex Validation
Validate response values using regular expressions.
Conditional Assertions
Perform assertions based on response conditions.
Soft & Hard Assertions
Practice both assertion strategies during API validation.
JSONPath Validation
Use JSONPath to extract:
- Single Values
- Multiple Values
- Nested Objects
for assertion.
Demo API Mapping
Practice using public APIs.
Authentication & Token Handling
Recommended API
- Restful Booker
Practice:
- Token Generation
- Authorization Headers
- Token Reuse
- Token Expiration
- Logout Validation
Secured API Access
Recommended API
- FakeStore API
Practice:
- Login
- Authentication
- Protected APIs
- 401 Validation
- 403 Validation
Response Validation
Recommended APIs
- DummyJSON
- JSONPlaceholder
- FakeStore API
Practice:
- Nested JSON
- Arrays
- Response Validation
- JSON Schema Validation
Frequently Asked Questions
How is authentication handled in REST Assured?
The workflow includes:
- Generate Token
- Extract Token
- Store Token
- Pass Token in Authorization Header
- Access Secured APIs
Which token scenarios should be tested?
Practice the following:
- Valid Token
- Invalid Token
- Expired Token
- Token Reuse
- Refresh Token
- Logout Validation
- Multi-User Sessions
- Role-Based Access
What is the difference between 401 and 403?
401 Unauthorized
Authentication is missing or invalid.
403 Forbidden
Authentication is successful, but access is not permitted.
Which response validations are important?
Validate:
- Status Codes
- Headers
- Mandatory Fields
- Data Types
- Nested Objects
- Arrays
- Null Values
- JSON Schema
- Error Schema
- Response Time
How is contract validation performed?
Validate the API response against the expected JSON Schema to ensure the response structure and data types remain consistent.
Which assertion methods are commonly used?
Practice using:
- Hamcrest Matchers
- JSONPath
- Regex Validation
- Soft Assertions
- Hard Assertions
