Testing authentication in FastAPI - Mini Project: Build & Apply

Testing authentication

📖 Scenario: You are building a simple FastAPI app that requires users to log in. You want to write tests to check if the authentication works correctly.

🎯 Goal: Create a test that checks if the login endpoint returns a success status when given correct credentials.

📋 What You'll Learn

Create a FastAPI app with a login endpoint

Add a test client to send requests to the app

Write a test function to check successful login

Use assertions to verify the response status code

💡 Why This Matters

🌍 Real World

Testing authentication endpoints is essential for any web app that requires user login to ensure security and correct behavior.

💼 Career

Backend developers and QA engineers often write tests for authentication to prevent security issues and bugs in production.

1

Create the FastAPI app with a login endpoint

Create a FastAPI app called app and add a POST endpoint /login that accepts JSON with username and password. Return {"message": "Login successful"} if username is "user1" and password is "pass123", else return {"message": "Invalid credentials"}.

FastAPI

from fastapi import FastAPI, HTTPException
from pydantic import BaseModel

app = FastAPI()

# Your code here

Hint

Use FastAPI() to create the app. Define a Pydantic model for the login data. Use @app.post("/login") to create the endpoint.

2

Set up the test client

Import TestClient from fastapi.testclient and create a test client called client for the app.

FastAPI

from fastapi import FastAPI, HTTPException
from pydantic import BaseModel
from fastapi.testclient import TestClient

app = FastAPI()

class LoginData(BaseModel):
    username: str
    password: str

@app.post("/login")
async def login(data: LoginData):
    if data.username == "user1" and data.password == "pass123":
        return {"message": "Login successful"}
    else:
        return {"message": "Invalid credentials"}

# Your code here

Hint

Import TestClient and create it by passing app.

3

Write a test function for successful login

Write a test function called test_login_success that uses client.post to send JSON {"username": "user1", "password": "pass123"} to /login. Store the response in a variable called response.

FastAPI

from fastapi import FastAPI, HTTPException
from pydantic import BaseModel
from fastapi.testclient import TestClient

app = FastAPI()

class LoginData(BaseModel):
    username: str
    password: str

@app.post("/login")
async def login(data: LoginData):
    if data.username == "user1" and data.password == "pass123":
        return {"message": "Login successful"}
    else:
        return {"message": "Invalid credentials"}

client = TestClient(app)

def test_login_success():
    # Your code here

Hint

Define a function named test_login_success. Use client.post with json= to send the login data.

4

Add assertion to check response status code

Inside the test_login_success function, add an assertion that checks if response.status_code is 200.

FastAPI

from fastapi import FastAPI, HTTPException
from pydantic import BaseModel
from fastapi.testclient import TestClient

app = FastAPI()

class LoginData(BaseModel):
    username: str
    password: str

@app.post("/login")
async def login(data: LoginData):
    if data.username == "user1" and data.password == "pass123":
        return {"message": "Login successful"}
    else:
        return {"message": "Invalid credentials"}

client = TestClient(app)

def test_login_success():
    response = client.post("/login", json={"username": "user1", "password": "pass123"})
    # Your code here

Hint

Use assert response.status_code == 200 to check the status code.

Practice

1. What is the main purpose of testing authentication in a FastAPI application?

easy

A. To improve the app's UI design

B. To speed up the server response time

C. To verify that only authorized users can access protected routes

D. To check database connection speed

Solution

1. Step 1: Understand authentication testing goal

   Authentication testing ensures users are properly verified before accessing certain parts of the app.

2. Step 2: Identify the correct purpose

   Only authorized users should access protected routes, which is what authentication testing checks.

3. Final Answer:

   To verify that only authorized users can access protected routes -> Option C

4. Quick Check:

   Authentication testing = verify authorized access [OK]

Hint: Authentication tests check user access control only [OK]

Common Mistakes:

• Confusing authentication with UI or performance testing
• Thinking authentication tests improve speed
• Mixing authentication with database tests

2. Which FastAPI tool is commonly used to simulate HTTP requests during authentication tests?

easy

A. HTTPServer

B. TestClient

C. RequestSimulator

D. AuthTester

Solution

1. Step 1: Recall FastAPI testing utilities

   FastAPI provides TestClient to simulate HTTP requests in tests easily.

2. Step 2: Match the tool to the name

   TestClient is the official tool; others are not part of FastAPI.

3. Final Answer:

   TestClient -> Option B

4. Quick Check:

   FastAPI request simulation = TestClient [OK]

Hint: Use TestClient to simulate requests in FastAPI tests [OK]

Common Mistakes:

• Using non-existent tools like HTTPServer or AuthTester
• Confusing TestClient with server components
• Not importing TestClient from fastapi.testclient

3. Given this FastAPI test code snippet, what will be the response status code when accessing a protected route without credentials?

from fastapi.testclient import TestClient
from main import app

client = TestClient(app)

response = client.get('/protected')
print(response.status_code)

medium

A. 401

B. 404

C. 200

D. 500

Solution

1. Step 1: Understand protected route behavior

   Protected routes require authentication; without credentials, access is denied.

2. Step 2: Identify expected HTTP status code

   Unauthorized access returns 401 status code, not 200 (success) or 404 (not found).

3. Final Answer:

   401 -> Option A

4. Quick Check:

   Unauthorized access = 401 status [OK]

Hint: No credentials on protected route returns 401 Unauthorized [OK]

Common Mistakes:

• Expecting 200 OK without authentication
• Confusing 401 with 404 Not Found
• Assuming server error 500 instead of auth error

4. Identify the error in this FastAPI authentication test code:

from fastapi.testclient import TestClient
from main import app

client = TestClient(app)

response = client.post('/login', json={'username': 'user', 'password': 'wrongpass'})
assert response.status_code == 200

medium

A. The TestClient import is incorrect

B. The client should use GET instead of POST

C. The JSON keys should be 'user' and 'pass' instead

D. The test expects status 200 even with wrong password

Solution

1. Step 1: Analyze expected login response

   Wrong password should cause login failure, usually status 401 or 403, not 200.

2. Step 2: Check test assertion correctness

   Asserting status 200 on wrong credentials is incorrect and will fail the test.

3. Final Answer:

   The test expects status 200 even with wrong password -> Option D

4. Quick Check:

   Wrong password should NOT return 200 [OK]

Hint: Wrong password login returns error, not 200 OK [OK]

Common Mistakes:

• Assuming POST is wrong method for login
• Using incorrect JSON keys for credentials
• Misimporting TestClient

5. You want to test a FastAPI route that requires a valid JWT token in the Authorization header. Which approach correctly simulates an authenticated request in your test?

from fastapi.testclient import TestClient
from main import app

client = TestClient(app)

# Options:
# A) client.get('/secure', headers={'Authorization': 'Bearer validtoken'})
# B) client.get('/secure')
# C) client.get('/secure', json={'token': 'validtoken'})
# D) client.get('/secure', cookies={'Authorization': 'validtoken'})

hard

A. Send the token in Authorization header with 'Bearer ' prefix

B. Send no token and expect access

C. Send token in JSON body for GET request

D. Send token as a cookie named Authorization

Solution

1. Step 1: Recall JWT token usage in HTTP requests

   JWT tokens are sent in the Authorization header with 'Bearer ' prefix for authentication.

2. Step 2: Evaluate each option's correctness

   Sending the token in the Authorization header with 'Bearer ' prefix correctly simulates authentication. No token, JSON body for GET, or cookies will fail.

3. Final Answer:

   Send the token in Authorization header with 'Bearer ' prefix -> Option A

4. Quick Check:

   JWT token in Authorization header = Send the token in Authorization header with 'Bearer ' prefix [OK]

Hint: JWT tokens go in Authorization header with 'Bearer ' prefix [OK]

Common Mistakes:

• Sending token in JSON body for GET requests
• Omitting the 'Bearer ' prefix
• Using cookies instead of headers for JWT