Verify user can login using token-based authentication

Preconditions (3)

Step 1: Send POST request to /api/login with valid username and password

Step 2: Receive authentication token in response

Step 3: Use the token to send GET request to /api/profile with Authorization header

Step 4: Verify the profile data is returned successfully

✅ Expected Result: User receives a valid token after login and can access protected profile data using the token

Automation Requirements - Cypress

Assertions Needed:

Response status code is 200 for login and profile requests

Response body of login contains a non-empty token string

Profile response contains expected user data fields

Best Practices:

Use cy.request() for API calls

Store token in alias or variable for reuse

Use assertions to check status and response body

Avoid hardcoding tokens; get dynamically from login response

Automated Solution

Cypress

describe('Token-based authentication test', () => {
  it('logs in and accesses protected profile using token', () => {
    // Step 1: Login and get token
    cy.request({
      method: 'POST',
      url: '/api/login',
      body: {
        username: 'testuser',
        password: 'TestPass123'
      }
    }).then((loginResponse) => {
      // Assert login success
      expect(loginResponse.status).to.equal(200);
      expect(loginResponse.body).to.have.property('token').and.to.be.a('string').and.not.be.empty;

      const token = loginResponse.body.token;

      // Step 2: Use token to access protected profile
      cy.request({
        method: 'GET',
        url: '/api/profile',
        headers: {
          Authorization: `Bearer ${token}`
        }
      }).then((profileResponse) => {
        // Assert profile access success
        expect(profileResponse.status).to.equal(200);
        expect(profileResponse.body).to.have.property('username', 'testuser');
        expect(profileResponse.body).to.have.property('email').and.to.be.a('string').and.not.be.empty;
      });
    });
  });
});

This test uses cy.request() to send API calls directly without UI interaction.

First, it sends a POST request to /api/login with username and password. It asserts the response status is 200 and that the response body contains a non-empty token string.

Then, it stores the token in a variable and uses it in the Authorization header to send a GET request to /api/profile. It asserts the profile response status is 200 and checks that expected user data fields like username and email are present and valid.

This approach ensures the token is dynamically retrieved and used, following best practices for token-based authentication testing.

Common Mistakes - 3 Pitfalls

Hardcoding the token value instead of retrieving it dynamically

Not asserting the response status codes

Using UI to login and then API to access profile without synchronizing token

Bonus Challenge

Now add data-driven testing with 3 different sets of valid username and password combinations to verify token-based authentication works for multiple users.

Show Hint