Testing authentication in FastAPI - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when an unauthenticated user accesses a protected route?

Consider a FastAPI app with a route protected by OAuth2 password bearer token authentication. What response does the client receive if no token is provided?

FastAPI

from fastapi import FastAPI, Depends, HTTPException, status
from fastapi.security import OAuth2PasswordBearer

app = FastAPI()
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

@app.get("/protected")
async def protected_route(token: str = Depends(oauth2_scheme)):
    return {"message": "Access granted"}

A HTTP 401 Unauthorized with detail 'Not authenticated'

B HTTP 403 Forbidden with detail 'Not enough permissions'

C HTTP 200 OK with message 'Access granted'

D HTTP 500 Internal Server Error

💡 Hint

Think about what happens when the OAuth2PasswordBearer dependency does not find a token.

When no token is provided, OAuth2PasswordBearer raises a 401 Unauthorized error with detail 'Not authenticated'. This prevents access to the protected route.

❓ state_output

intermediate

What is the value of 'user' after successful token validation?

Given a FastAPI dependency that decodes a JWT token and returns a user dictionary, what is the value of user inside the route after passing a valid token?

FastAPI

from fastapi import FastAPI, Depends, HTTPException
from fastapi.security import OAuth2PasswordBearer

app = FastAPI()
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

fake_users_db = {"alice": {"username": "alice", "email": "[e-mail]"}}

def get_current_user(token: str = Depends(oauth2_scheme)):
    # Simulate decoding token to username
    username = token
    user = fake_users_db.get(username)
    if not user:
        raise HTTPException(status_code=400, detail="Invalid user")
    return user

@app.get("/me")
async def read_users_me(user: dict = Depends(get_current_user)):
    return user

A {"username": "bob", "email": "[e-mail]"}

B None

C {"username": "alice", "email": "[e-mail]"}

D Raises HTTPException with status 400

💡 Hint

Check what the token string is and how it maps to the fake user database.

The token string is used as the username key to look up the user in fake_users_db. If the token is 'alice', the user dictionary for Alice is returned.

📝 Syntax

advanced

Which option correctly implements a FastAPI dependency to verify an API key header?

Choose the code snippet that correctly defines a dependency to check for an API key in the header X-API-Key and raises 403 if missing or invalid.

A

from fastapi import Header, HTTPException

def verify_api_key(x_api_key: str = Header):
    if x_api_key != "secret123":
        raise HTTPException(status_code=403, detail="Invalid API Key")

B

from fastapi import Header, HTTPException, status

def verify_api_key(x_api_key: str = Header(None)):
    if x_api_key != "secret123":
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid API Key")

C

from fastapi import Header, HTTPException, status

def verify_api_key(x_api_key: str = Header(...)):
    if x_api_key == "secret123":
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid API Key")

D

from fastapi import Header, HTTPException, status

def verify_api_key(x_api_key: str = Header(...)):
    if x_api_key != "secret123":
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid API Key")

💡 Hint

Remember that Header(...) means the header is required. Also check the status code and condition logic.

Option D correctly requires the header, checks if it matches the secret, and raises 403 Forbidden if invalid. Option D misses required header syntax. Option D uses 401 instead of 403 and makes header optional. Option D reverses the condition.

🔧 Debug

advanced

Why does this FastAPI test for authentication fail with 422 Unprocessable Entity?

Given this test code for a FastAPI endpoint requiring a token, why does the test fail with status 422 instead of 401?

FastAPI

from fastapi.testclient import TestClient

client = TestClient(app)

def test_protected_route():
    response = client.get("/protected")
    assert response.status_code == 401

A The OAuth2PasswordBearer dependency expects the token in the Authorization header, but the test sends no header, causing validation error 422.

B The test client automatically adds an invalid token causing 422 error.

C The route does not require authentication, so 422 is returned by mistake.

D The test is missing a JSON body, which is required by the route.

💡 Hint

Check how OAuth2PasswordBearer expects the token to be sent in requests.

OAuth2PasswordBearer expects the token in the Authorization header as a Bearer token. If missing, FastAPI raises a 401 error normally, but if the header is missing and the dependency is used incorrectly or the test client does not send the header, it can cause a 422 validation error.

🧠 Conceptual

expert

Which statement best describes the role of dependencies in FastAPI authentication testing?

When writing tests for FastAPI authentication, what is the main advantage of using dependency overrides?

A They automatically generate valid tokens for testing protected routes.

B They allow replacing real authentication logic with mock functions to simulate authenticated users without real tokens.

C They disable authentication checks entirely during tests.

D They enforce stricter validation rules on tokens during testing.

💡 Hint

Think about how to test routes without relying on real authentication mechanisms.

Dependency overrides let you replace authentication dependencies with mock versions that simulate authenticated users. This makes tests faster and simpler without needing real tokens or external auth services.