Testing authentication flows in Express - Step-by-Step Execution

Concept Flow - Testing authentication flows

Start Test

↓

Send Login Request

↓

Check Credentials

↓

Generate Token

↓

Send Response

↓

Verify Response

↓

End Test

This flow shows how a test sends a login request, checks credentials, returns a token or error, and verifies the response.

Execution Sample

Express

test('login success', async () => {
  const res = await request(app)
    .post('/login')
    .send({ username: 'user', password: 'pass' });
  expect(res.statusCode).toBe(200);
  expect(res.body.token).toBeDefined();
});

This test sends a login request and checks if the response status is 200 and a token is returned.

Execution Table

Step	Action	Input	Internal Check	Output	Test Assertion
1	Send POST /login	{username:'user', password:'pass'}	N/A	Request sent	N/A
2	Check credentials	user/pass	Credentials valid?	Yes	N/A
3	Generate token	user info	Token created	Token string	N/A
4	Send response	Token string	Response status 200	{token: '...'}	N/A
5	Verify response	{token: '...'}	Status 200 and token present	Pass	expect(res.statusCode).toBe(200) and expect(res.body.token).toBeDefined()
6	Test ends	N/A	N/A	Test passed	Test completes successfully

💡 Test ends after verifying response status and token presence

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
res.statusCode	undefined	undefined	undefined	200	200
res.body.token	undefined	undefined	token string	token string	token string

Key Moments - 2 Insights

Why do we check both status code and token in the response?

Because status code 200 means success, but token presence confirms authentication succeeded. See execution_table rows 4 and 5.

What happens if credentials are invalid?

The internal check fails at step 2, and the server returns an error response instead of a token. This stops the test from passing.

Visual Quiz - 3 Questions

Look at the execution table, what is the status code after step 4?

A 200

B 401

C 500

D undefined

💡 Hint

Check the 'Output' column at step 4 in the execution_table.

At which step is the token generated?

A Step 4

B Step 2

C Step 3

D Step 5

💡 Hint

Look at the 'Action' column in execution_table where token creation happens.

If the credentials were invalid, what would change in the execution table?

A Response status would be 200

B Step 2 would show 'No' and no token generated

C Step 3 would generate a token anyway

D Test would pass

💡 Hint

Refer to key_moments about invalid credentials and execution_table step 2.

Concept Snapshot

Testing authentication flows in Express:
- Send POST request with credentials
- Server checks credentials
- If valid, generate token and respond 200
- If invalid, respond with error
- Test asserts status and token presence
- Use supertest for request simulation

Full Transcript

This visual execution shows how to test authentication flows in Express. The test sends a login request with username and password. The server checks if credentials are valid. If yes, it generates a token and sends it back with status 200. The test then verifies the response status and token presence to confirm success. If credentials are invalid, the server returns an error and no token. The test fails in that case. This step-by-step trace helps beginners see how requests, checks, and responses happen in authentication testing.