Testing authentication in FastAPI

Introduction

Testing authentication helps make sure only the right users can access your app. It checks if login and security work correctly.

When you want to check if users can log in with correct credentials.

When you want to verify that unauthorized users cannot access protected pages.

When you want to test token or session-based login flows.

When you want to make sure logout works and ends the user session.

When you want to catch bugs in your security code before users see them.

Syntax

FastAPI

from fastapi.testclient import TestClient
from your_app import app

client = TestClient(app)

response = client.post('/login', data={'username': 'user', 'password': 'pass'})
assert response.status_code == 200
assert 'access_token' in response.json()

Use TestClient from FastAPI to simulate requests to your app.

Check response status and content to confirm authentication success or failure.

Examples

Test successful login returns a token.

FastAPI

response = client.post('/login', data={'username': 'alice', 'password': 'secret'})
assert response.status_code == 200
assert 'access_token' in response.json()

Test login fails with wrong password.

FastAPI

response = client.post('/login', data={'username': 'alice', 'password': 'wrong'})
assert response.status_code == 401

Test access to a protected route with a valid token.

FastAPI

response = client.get('/protected-route', headers={'Authorization': 'Bearer validtoken'})
assert response.status_code == 200

Test access denied without token.

FastAPI

response = client.get('/protected-route')
assert response.status_code == 401

Sample Program

This FastAPI app has a simple login endpoint and a protected route. The test client checks login success, failure, and access control.

FastAPI

from fastapi import FastAPI, Depends, HTTPException, status
from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm
from fastapi.testclient import TestClient

app = FastAPI()

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

fake_users_db = {
    "johndoe": {
        "username": "johndoe",
        "password": "secret"
    }
}

def fake_verify_token(token: str):
    if token == "validtoken":
        return True
    return False

@app.post("/token")
async def login(form_data: OAuth2PasswordRequestForm = Depends()):
    user = fake_users_db.get(form_data.username)
    if not user or user["password"] != form_data.password:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Incorrect username or password"
        )
    return {"access_token": "validtoken", "token_type": "bearer"}

@app.get("/protected-route")
async def protected_route(token: str = Depends(oauth2_scheme)):
    if not fake_verify_token(token):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid authentication credentials"
        )
    return {"message": "You are authenticated"}

client = TestClient(app)

def test_authentication():
    # Test successful login
    response = client.post("/token", data={"username": "johndoe", "password": "secret"})
    assert response.status_code == 200
    assert "access_token" in response.json()

    # Test failed login
    response = client.post("/token", data={"username": "johndoe", "password": "wrong"})
    assert response.status_code == 401

    # Test access protected route with valid token
    response = client.get("/protected-route", headers={"Authorization": "Bearer validtoken"})
    assert response.status_code == 200
    assert response.json() == {"message": "You are authenticated"}

    # Test access protected route without token
    response = client.get("/protected-route")
    assert response.status_code == 401

# Run tests
if __name__ == "__main__":
    test_authentication()
    print("All authentication tests passed.")

Important Notes

Always test both success and failure cases for authentication.

Use TestClient to simulate real HTTP requests in tests.

Keep test data simple and clear to understand what is being tested.

Summary

Testing authentication ensures your app only lets in the right users.

Use FastAPI's TestClient to simulate login and protected route access.

Check both successful and failed login attempts to cover all cases.

Practice

1. What is the main purpose of testing authentication in a FastAPI application?

easy

A. To improve the app's UI design

B. To speed up the server response time

C. To verify that only authorized users can access protected routes

D. To check database connection speed

Solution

1. Step 1: Understand authentication testing goal

   Authentication testing ensures users are properly verified before accessing certain parts of the app.

2. Step 2: Identify the correct purpose

   Only authorized users should access protected routes, which is what authentication testing checks.

3. Final Answer:

   To verify that only authorized users can access protected routes -> Option C

4. Quick Check:

   Authentication testing = verify authorized access [OK]

Hint: Authentication tests check user access control only [OK]

Common Mistakes:

• Confusing authentication with UI or performance testing
• Thinking authentication tests improve speed
• Mixing authentication with database tests

2. Which FastAPI tool is commonly used to simulate HTTP requests during authentication tests?

easy

A. HTTPServer

B. TestClient

C. RequestSimulator

D. AuthTester

Solution

1. Step 1: Recall FastAPI testing utilities

   FastAPI provides TestClient to simulate HTTP requests in tests easily.

2. Step 2: Match the tool to the name

   TestClient is the official tool; others are not part of FastAPI.

3. Final Answer:

   TestClient -> Option B

4. Quick Check:

   FastAPI request simulation = TestClient [OK]

Hint: Use TestClient to simulate requests in FastAPI tests [OK]

Common Mistakes:

• Using non-existent tools like HTTPServer or AuthTester
• Confusing TestClient with server components
• Not importing TestClient from fastapi.testclient

3. Given this FastAPI test code snippet, what will be the response status code when accessing a protected route without credentials?

from fastapi.testclient import TestClient
from main import app

client = TestClient(app)

response = client.get('/protected')
print(response.status_code)

medium

A. 401

B. 404

C. 200

D. 500

Solution

1. Step 1: Understand protected route behavior

   Protected routes require authentication; without credentials, access is denied.

2. Step 2: Identify expected HTTP status code

   Unauthorized access returns 401 status code, not 200 (success) or 404 (not found).

3. Final Answer:

   401 -> Option A

4. Quick Check:

   Unauthorized access = 401 status [OK]

Hint: No credentials on protected route returns 401 Unauthorized [OK]

Common Mistakes:

• Expecting 200 OK without authentication
• Confusing 401 with 404 Not Found
• Assuming server error 500 instead of auth error

4. Identify the error in this FastAPI authentication test code:

from fastapi.testclient import TestClient
from main import app

client = TestClient(app)

response = client.post('/login', json={'username': 'user', 'password': 'wrongpass'})
assert response.status_code == 200

medium

A. The TestClient import is incorrect

B. The client should use GET instead of POST

C. The JSON keys should be 'user' and 'pass' instead

D. The test expects status 200 even with wrong password

Solution

1. Step 1: Analyze expected login response

   Wrong password should cause login failure, usually status 401 or 403, not 200.

2. Step 2: Check test assertion correctness

   Asserting status 200 on wrong credentials is incorrect and will fail the test.

3. Final Answer:

   The test expects status 200 even with wrong password -> Option D

4. Quick Check:

   Wrong password should NOT return 200 [OK]

Hint: Wrong password login returns error, not 200 OK [OK]

Common Mistakes:

• Assuming POST is wrong method for login
• Using incorrect JSON keys for credentials
• Misimporting TestClient

5. You want to test a FastAPI route that requires a valid JWT token in the Authorization header. Which approach correctly simulates an authenticated request in your test?

from fastapi.testclient import TestClient
from main import app

client = TestClient(app)

# Options:
# A) client.get('/secure', headers={'Authorization': 'Bearer validtoken'})
# B) client.get('/secure')
# C) client.get('/secure', json={'token': 'validtoken'})
# D) client.get('/secure', cookies={'Authorization': 'validtoken'})

hard

A. Send the token in Authorization header with 'Bearer ' prefix

B. Send no token and expect access

C. Send token in JSON body for GET request

D. Send token as a cookie named Authorization

Solution

1. Step 1: Recall JWT token usage in HTTP requests

   JWT tokens are sent in the Authorization header with 'Bearer ' prefix for authentication.

2. Step 2: Evaluate each option's correctness

   Sending the token in the Authorization header with 'Bearer ' prefix correctly simulates authentication. No token, JSON body for GET, or cookies will fail.

3. Final Answer:

   Send the token in Authorization header with 'Bearer ' prefix -> Option A

4. Quick Check:

   JWT token in Authorization header = Send the token in Authorization header with 'Bearer ' prefix [OK]

Hint: JWT tokens go in Authorization header with 'Bearer ' prefix [OK]

Common Mistakes:

• Sending token in JSON body for GET requests
• Omitting the 'Bearer ' prefix
• Using cookies instead of headers for JWT